CVE-2026-47754

CVE-2026-47754 affects Metacat 2.x (including 2.19.1) and all 1.x versions, with an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint. The bug stems from ArchiveHandler.readArchiveEntry() concatenating user input into a filesystem path and a disabled has...