Executive brief
pygeoapi is a Python-based server used to publish geospatial data according to international standards. A security flaw in its file management plugin allows unauthorized users to access sensitive directories and files on the host server. This risk is particularly high for installations that are directly exposed to the internet without a protective web proxy. An attacker could exploit this to view private system files or internal data without needing a password.
Technical details
A path traversal vulnerability (CWE-22) exists in the STAC FileSystemProvider plugin of pygeoapi due to improper neutralization of '..' sequences during raw string path concatenation. The flaw is exploitable when pygeoapi is configured with a 'stac-collection' resource and is deployed without a front-end proxy (like Nginx or Apache) that normalizes URLs. An unauthenticated attacker can send specially crafted network requests containing directory traversal sequences to escape the intended resource directory and read sensitive files from the underlying filesystem. The issue is addressed in version 0.23.3 by implementing secure resource pathing.
Affected products
- geopython pygeoapi >= 0.23.0, < 0.23.3
Timeline
- 2026-04-22: patched: Fix released in version 0.23.3 and advisory published by maintainers.
- 2026-05-08: disclosed: CVE-2026-42351 published to NVD.