CVE-2026-47754

Name of the Vulnerable Software and Affected Versions Metacat versions 1.x through 2.19.1

Description Metacat contains an unauthenticated path traversal issue within the original 1.x API. The action=read endpoint fails to validate the archiveEntryName parameter, which is then concatenated into a filesystem path by the readArchiveEntry() function. Additionally, the hasReadPermission() check is commented out, allowing an unauthenticated remote attacker to read any file accessible to the Tomcat process via a single GET request. This can lead to credential theft, exfiltration of client certificates and private keys for member node impersonation, disclosure of embargoed research data, and broad system reconnaissance.

Recommendations Update to Metacat version 3.0.0 or later. As a temporary workaround, disable or restrict access to the 1.x API servlets and restart Tomcat or the software hosting the servlets.