Path Traversal Vulnerability in Metacat Data Repository Software

CVE-2026-47754

What is CVE-2026-47754?

Metacat, a data repository software used for preserving, sharing, and discovering research data, is susceptible to a path traversal vulnerability that affects versions earlier than 3.0.0. Specifically, the issue lies within the archiveEntryName parameter in the action=read endpoint of the legacy 1.x Metacat API. Due to a lack of parameter validation in the ArchiveHandler.readArchiveEntry() method and a commented-out permission check, an unauthenticated attacker can exploit this flaw with a simple GET request, potentially gaining access to any file the Tomcat process can read. This vulnerability poses a significant risk, facilitating unauthorized file access, credential theft, and exposure of sensitive research data. The issue has been verified with proof-of-concept exploits and affects a considerable number of Metacat deployments across various data repositories. The vulnerability was addressed in version 3.0.0 by fully removing the 1.x API, and users are advised to disable or restrict access to 1.x API servlets to mitigate exposure.

References