Read the docs
TI-2026-30653 Aliases CVE-2026-42351GHSA-f6pr-83pg-ghh6

pygeoapi: Path Traversal in STAC FileSystemProvider

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Fixed pygeoapi (geopython): 0.23.3pygeoapi (PyPI): 0.23.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geopythonpygeoapi0.23.0 to before 0.23.30.23.3Patch availableCNA
—pygeoapi (PyPI)0.23.0 to before 0.23.30.23.3Patch availableGHSA-f6pr-83pg-ghh6
  • pygeoapi Vendorgeopython Affected 0.23.0 to before 0.23.3 Fixed in 0.23.3 Patch available CNA
  • pygeoapi (PyPI) Vendor— Affected 0.23.0 to before 0.23.3 Fixed in 0.23.3 Patch available GHSA-f6pr-83pg-ghh6

Remediation

  • Fix · CNA pygeoapi (geopython) Fixed in 0.23.3
  • Fix · GHSA-f6pr-83pg-ghh6 pygeoapi (PyPI) Fixed in 0.23.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42351
  2. 2026-10-03 Alias added: GHSA-f6pr-83pg-ghh6
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 4

  • TI-2026-30654 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber CVSS 3.1HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences