CVE-2026-42351: pygeoapi Path Traversal Vulnerability

CVE-2026-42351 Overview

pygeoapi is a Python server implementation of the Open Geospatial Consortium (OGC) API suite of standards. CVE-2026-42351 is a path traversal vulnerability [CWE-22] in the STAC FileSystemProvider plugin. The flaw stems from raw string path concatenation when handling requests to SpatioTemporal Asset Catalog (STAC) collection-based resources. An unauthenticated attacker can submit crafted URLs containing .. sequences to traverse directories outside the intended resource scope. The vulnerability affects pygeoapi versions 0.23.0 through 0.23.2 and is patched in 0.23.3.

Critical Impact
Unauthenticated network attackers can enumerate and read directory contents on servers running affected pygeoapi versions when deployed without a URL-normalizing proxy.

Affected Products

pygeoapi 0.23.0 through 0.23.2
Deployments using STAC FileSystemProvider with stac-collection resource type
Instances deployed without a reverse proxy or web front end that normalizes .. URL segments

Discovery Timeline

2026-05-08 - CVE-2026-42351 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42351

Vulnerability Analysis

The vulnerability resides in the STAC FileSystemProvider plugin within pygeoapi/provider/filesystem.py. The provider concatenates user-supplied path components with the configured base directory using raw string operations. This concatenation does not canonicalize the resulting path or reject .. traversal sequences. Attackers can issue HTTP requests to STAC collection endpoints that include parent-directory references in the URL path. The server then resolves these paths against the underlying filesystem and returns directory listings outside the configured resource boundary.

The issue only manifests when two conditions are present together. First, pygeoapi must be deployed directly without a reverse proxy or web front end that normalizes URLs containing .. segments. Second, a resource of type stac-collection must be defined in the pygeoapi configuration. Many production deployments place pygeoapi behind nginx or Apache, which collapse .. segments before forwarding requests, neutralizing the attack.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The FileSystemProvider plugin trusted request-supplied path fragments and combined them with the resource root using string concatenation. No os.path.realpath validation or prefix check was performed to confirm that the resolved path remained within the intended directory.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to a STAC collection endpoint with a path containing .. segments. Because the request is delivered to pygeoapi without URL normalization, the embedded traversal sequences reach the provider logic. The provider resolves the path against the filesystem and returns listings of parent directories. The impact is confidentiality loss; integrity and availability are not affected.

python

# Patch from pygeoapi/provider/filesystem.py
# Source: https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52
#
# Authors: Tom Kralidis <tomkralidis@gmail.com>
#
# Copyright (c) 2026 Tom Kralidis
#
# STAC: secure resource pathing - the patch hardens path resolution
# in the FileSystemProvider to prevent directory traversal via raw
# string concatenation of user-supplied path components.

Source: GitHub Commit bf25b86

Detection Methods for CVE-2026-42351

Indicators of Compromise

HTTP request logs containing ..%2F, ../, or encoded traversal sequences targeting /collections/ or STAC endpoints
Responses from pygeoapi returning directory listings for paths outside the configured STAC resource root
Unusual 200 OK responses to requests with .. segments in the URL path against pygeoapi hosts

Detection Strategies

Inspect access logs for requests matching the pattern GET /collections/<stac-collection>/.*\.\. against pygeoapi servers
Audit running pygeoapi instances for stac-collection resource definitions combined with direct exposure to the internet
Compare installed pygeoapi versions against the patched release 0.23.3 across inventory

Monitoring Recommendations

Forward pygeoapi web server logs to a centralized log platform and alert on traversal patterns in request URIs
Monitor outbound responses for unexpected directory listing structures originating from STAC endpoints
Track filesystem read events on pygeoapi hosts to identify access to paths outside the configured STAC data directory

How to Mitigate CVE-2026-42351

Immediate Actions Required

Upgrade pygeoapi to version 0.23.3 or later, which patches the FileSystemProvider path handling
Place pygeoapi behind a reverse proxy such as nginx or Apache that normalizes .. segments in request URLs
Audit pygeoapi configurations for stac-collection resources and review the underlying filesystem paths for sensitive content

Patch Information

The fix is included in pygeoapi 0.23.3, released by the geopython project. The patch hardens path resolution in pygeoapi/provider/filesystem.py so STAC resource requests cannot escape the configured directory. Review the GitHub Security Advisory GHSA-f6pr-83pg-ghh6 and the GitHub Release 0.23.3 for full details.

Workarounds

Deploy pygeoapi behind a web front end such as nginx that collapses .. URL segments before forwarding requests
Remove stac-collection resource definitions from the pygeoapi configuration if upgrade is not immediately feasible
Restrict filesystem permissions for the pygeoapi process so STAC data directories cannot read parent paths containing sensitive files

bash

# nginx configuration snippet to normalize URLs and block traversal
location /pygeoapi/ {
    merge_slashes on;
    if ($request_uri ~* "\.\.") {
        return 400;
    }
    proxy_pass http://127.0.0.1:5000/;
}