# CVE-2026-50022: NCEAS Metacat path traversal disclosure in Solr query handler

Source: https://junglewise.ai/threats/cve-2026-50022-nceas-metacat-path-traversal-disclosure-in-solr-query-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-50022 · Severity: medium · CVSS 5.8 · Published 2026-09-17

Metacat is data repository software used by researchers to preserve and share scientific data. An unauthenticated attacker can exploit a vulnerability in the search endpoint to bypass access controls and retrieve sensitive configuration files from the Solr backend, such as solrconfig.xml, which may expose internal infrastructure details and aid further attacks.

Technologies: [NCEAS Metacat](https://junglewise.ai/threats/technologies/metacat). Vendors: [NCEAS](https://junglewise.ai/threats/vendors/nceas).

## Quick answers

**Is CVE-2026-50022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50022 being exploited in the wild.

**How severe is CVE-2026-50022?** Medium severity, with a CVSS score of 5.8, published 17 September 2026.

**Which products and versions are affected?** NCEAS Metacat before 3.4.2.

**Is there a fix for CVE-2026-50022?** A patch was published on 2026-05-26: Fixed in version 3.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50022 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50022?** Check whether you run NCEAS Metacat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a parameter injection attack in the MetacatSolrIndex.query method. The client-controlled qt parameter from search requests (e.g., /d1/mn/v2/query/solr/) is forwarded unsanitized through Apache SolrJ to the backend Solr instance. An attacker can inject the /admin/file handler via the qt parameter; even when Solr is hardened with handleSelect=false (Solr 7.0+), SolrJ reformats the request in a way that bypasses this protection. The Solr backend returns the requested core configuration file, which Metacat embeds in an XML processing error response, leaking sensitive internal files. No authentication is required; the attack is network-accessible from any client. The vulnerability is fixed in Metacat 3.4.2 by rejecting queries containing the qt parameter.

## Affected products

- NCEAS Metacat before 3.4.2

## Timeline

- 2026-09-17: disclosed
- 2026-05-26: patched: Fixed in version 3.4.2

## References

- [https://github.com/NCEAS/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec](https://github.com/NCEAS/metacat/commit/d500306188881d768b93f189bb8ddbf090f3f1ec)
- [https://github.com/NCEAS/metacat/pull/2319](https://github.com/NCEAS/metacat/pull/2319)

## Related threats

- [NCEAS Metacat SQL injection in harvesterRegistration endpoint](https://junglewise.ai/threats/cve-2026-48114-nceas-metacat-sql-injection-in-harvesterregistration-endpoint)