CVE-2026-47754: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in NCEAS metacat
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets.
AI Analysis
Technical Summary
Metacat versions 1.x and 2.x through 2.19.1 contain an unauthenticated path traversal vulnerability (CWE-22) in the 'archiveEntryName' parameter of the 'action=read' endpoint in the legacy 1.x API. The vulnerable method ArchiveHandler.readArchiveEntry() concatenates user input into a filesystem path without validation, and the intended read permission check is commented out, allowing attackers to read any file accessible to the Tomcat process with a single GET request. This vulnerability enables credential theft, private key exfiltration, embargoed data disclosure, and system reconnaissance. The vulnerability was eliminated in Metacat 3.0.0 by removing the entire 1.x API. The 2.x branch, including version 2.19.1, remains vulnerable and unsupported. No official patch backport exists for 2.x. Mitigation involves disabling or restricting the 1.x API servlets and restarting the hosting server.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible to the Tomcat process hosting Metacat. This can lead to credential theft, exfiltration of client certificates and private keys, impersonation within the federation, disclosure of embargoed research data, and broad system reconnaissance. The vulnerability affects production deployments across the DataONE network and federally funded research programs, making the exposure significant. There is no known exploitation in the wild, but proof-of-concept exploits have been demonstrated and verified.
Mitigation Recommendations
The vulnerability is remediated in Metacat version 3.0.0 and later by removing the legacy 1.x API including ArchiveHandler.java. The 2.x branch will not receive backported fixes. For 2.x deployments, especially 2.19.1, it is recommended to disable or restrict access to the 1.x API servlets to reduce or eliminate exposure. After disabling these endpoints, restart Tomcat or the hosting software. Since the 1.x API is no longer necessary in most deployments, this workaround is effective. Patch status is not explicitly confirmed for 2.x; check vendor guidance for updates.
CVE-2026-47754: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in NCEAS metacat
Description
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets.
CVSS v3.1
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Metacat versions 1.x and 2.x through 2.19.1 contain an unauthenticated path traversal vulnerability (CWE-22) in the 'archiveEntryName' parameter of the 'action=read' endpoint in the legacy 1.x API. The vulnerable method ArchiveHandler.readArchiveEntry() concatenates user input into a filesystem path without validation, and the intended read permission check is commented out, allowing attackers to read any file accessible to the Tomcat process with a single GET request. This vulnerability enables credential theft, private key exfiltration, embargoed data disclosure, and system reconnaissance. The vulnerability was eliminated in Metacat 3.0.0 by removing the entire 1.x API. The 2.x branch, including version 2.19.1, remains vulnerable and unsupported. No official patch backport exists for 2.x. Mitigation involves disabling or restricting the 1.x API servlets and restarting the hosting server.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files accessible to the Tomcat process hosting Metacat. This can lead to credential theft, exfiltration of client certificates and private keys, impersonation within the federation, disclosure of embargoed research data, and broad system reconnaissance. The vulnerability affects production deployments across the DataONE network and federally funded research programs, making the exposure significant. There is no known exploitation in the wild, but proof-of-concept exploits have been demonstrated and verified.
Mitigation Recommendations
The vulnerability is remediated in Metacat version 3.0.0 and later by removing the legacy 1.x API including ArchiveHandler.java. The 2.x branch will not receive backported fixes. For 2.x deployments, especially 2.19.1, it is recommended to disable or restrict access to the 1.x API servlets to reduce or eliminate exposure. After disabling these endpoints, restart Tomcat or the hosting software. Since the 1.x API is no longer necessary in most deployments, this workaround is effective. Patch status is not explicitly confirmed for 2.x; check vendor guidance for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T22:16:39.505Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7a1b7bbf8831d53954760c
Added to database: 08/10/2026, 18:42:03 UTC
Last enriched: 08/10/2026, 18:56:10 UTC
Last updated: 09/07/2026, 10:52:09 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.