# CVE-2026-47754: Metacat unauthenticated path traversal in archiveEntryName parameter

Source: https://junglewise.ai/threats/cve-2026-47754-metacat-unauthenticated-path-traversal-in-archiveentryname  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47754 · Severity: critical · CVSS 9.3 · Published 2026-08-10

Metacat is a data repository platform used by research organizations to preserve and share scientific data. A critical vulnerability allows unauthenticated attackers to read any file on the server by exploiting an unsafe parameter in the legacy API, potentially exposing sensitive research data, credentials, and cryptographic keys. This directly impacts the security of research institutions, data preservation initiatives, and the broader DataONE federation network.

## Quick answers

**Is CVE-2026-47754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47754 being exploited in the wild.

**How severe is CVE-2026-47754?** Critical severity, with a CVSS score of 9.3, published 10 August 2026.

**Which products and versions are affected?** Metacat Metacat 1.x and 2.x through 2.19.1.

**Is there a fix for CVE-2026-47754?** A patch was published on 2024-04: Vulnerability eliminated in Metacat 3.0.0 by removal of legacy 1.x API Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47754 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47754?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint in the legacy Metacat 1.x API. The `ArchiveHandler.readArchiveEntry()` method concatenates user-supplied input directly into a filesystem path without sanitization, and the permission check function `hasReadPermission()` is commented out. An unauthenticated remote attacker can craft a single GET request with traversal sequences (e.g., `../`) to read arbitrary files accessible to the Tomcat process. The vulnerability affects Metacat versions 1.x and 2.x through 2.19.1 and was resolved in version 3.0.0 by removing the vulnerable 1.x API entirely. There is no patch for the 2.x branch; upgrading to 3.0.0 or later is required for a permanent fix.

## Affected products

- Metacat Metacat 1.x and 2.x through 2.19.1

## Timeline

- 2026-08-10: disclosed
- 2024-04: patched: Vulnerability eliminated in Metacat 3.0.0 by removal of legacy 1.x API