CVE-2026-42351

CVE-2026-42351 affects pygeoapi prior to 0.23.3. A raw string path concatenation vulnerability in the STAC FileSystemProvider can allow requests to STAC collection based resources to expose directories without authentication, when deployed without URL-normalizing proxies and with a stac-collectio...

CVE-2026-42351 pygeoapi: Path Traversal in STAC FileSystemProvider

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories...

CVE-2026-42351

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories...