CVE-2026-42351

🗓️ 08 May 2026 22:31:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 4 Views

Path traversal in STAC FileSystemProvider may expose directories; affected pygeoapi 0.23.0–0.23.2, fixed 0.23.3.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-42351	8 May 202622:31	–	attackerkb
Circl	CVE-2026-42351	8 May 202623:20	–	circl
CNNVD	pygeoapi 路径遍历漏洞	8 May 202600:00	–	cnnvd
Cvelist	CVE-2026-42351 pygeoapi: Path Traversal in STAC FileSystemProvider	8 May 202622:31	–	cvelist
Github Security Blog	pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider	29 Apr 202622:18	–	github
NVD	CVE-2026-42351	8 May 202623:16	–	nvd
OSV	GHSA-F6PR-83PG-GHH6 pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider	29 Apr 202622:18	–	osv
Positive Technologies	PT-2026-36111	29 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-42351	12 May 202608:20	–	redhatcve
Snyk	Directory Traversal	29 Apr 202622:18	–	snyk

Vulners

Node

geopython pygeoapiRange0.23.0–0.23.3

[
  {
    "vendor": "geopython",
    "product": "pygeoapi",
    "versions": [
      {
        "version": ">= 0.23.0, < 0.23.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/geopython/pygeoapi/security/advisories/GHSA-f6pr-83pg-ghh6
github	www.github.com/geopython/pygeoapi/releases/tag/0.23.3
github	www.github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52

12 May 2026 16:41Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00042

SSVC

CWE-22