Description

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented out. An unauthenticated remote attacker can read any file accessible to the Tomcat process by sending a single GET request. Proof-of-concept exploits have been demonstrated and verified against this vulnerability, and it should be considered easily exploitable for any Metacat deployment < 3.0.0 by any user with access to the 1.x API. Through this vulnerability, production 2.x deployments are exposed to credential theft, client certificate and private key exfiltration enabling member node impersonation within the federation, embargoed research data disclosure, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the population of exposed 2.x instances is non-trivial. The vulnerability was eliminated in Metacat version 3.0.0 and after by eliminating the entire Metacat 1.x API that exposed this vulnerability. The vulnerability was remediated in April 2024 with the release of Metacat 3.0.0, which removed the legacy Metacat API including ArchiveHandler.java. The commit message and issue reference architectural cleanup, not a security fix, and no advisory or CVE was issued. The 2.x branch was not and will not be backported, as is standard practice in Metacat, which only supports the most current release. 2.19.1 remains vulnerable with identical code and is beyond its supported lifetime. As a workaround, disable or restrict 1.x API servlets. Because the vulnerable 1.x API is no longer used or necessary in most Metacat deployments, restricting access to the old API endpoints can reduce or eliminate exposure for 2.19.x deployments. After removing those features, restart Tomcat or whichever software is hosting the servlets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-10T16:19:47.797Z",
  "pubdate": "2026-08-10T16:19:47.797Z",
  "executiveSummary": "Metacat versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal vulnerability. The flaw exists within the archiveEntryName parameter of the action=read endpoint, which is part of the legacy 1.x Metacat API. An unauthenticated remote attacker can exploit this vulnerability by sending a single crafted GET request to read arbitrary files accessible to the Tomcat process hosting the application.\nThe impact of successful exploitation includes credential theft, the exfiltration of client certificates and private keys enabling member node impersonation within the federation, the unauthorized disclosure of embargoed research data, and broad system reconnaissance. Given Metacat's deployment footprint across the DataONE network of repositories and federally funded research programs, the exposure of vulnerable 2.x instances introduces severe risks to data confidentiality and federation integrity.\nThe vulnerability is easily exploitable for any Metacat deployment below version 3.0.0 that has access enabled to the legacy 1.x API. No authentication or privileges are required. Remediation requires upgrading to Metacat version 3.0.0 or later, which eliminates the entire vulnerable 1.x API. As branch 2.x will not receive backports, deployments unable to upgrade immediately must apply workarounds such as disabling or restricting access to the affected 1.x API servlets.",
  "technicalDetails": "The vulnerability is rooted in insecure handling of user-supplied input within the ArchiveHandler.readArchiveEntry() function. Specifically, the method concatenates the unvalidated archiveEntryName parameter directly into a filesystem path. Furthermore, the surrounding hasReadPermission() authorization check that should govern access control is commented out in the source code.\nThe attack vector involves network exposure via the original 1.x Metacat API endpoints hosted by the Tomcat process. An unauthenticated remote attacker can initiate exploitation by transmitting a single HTTP GET request targeting the action=read endpoint with a manipulated archiveEntryName parameter containing path traversal sequences. Because the application fails to sanitize or validate the parameter against the intended directory base, the underlying Java file I/O operations traverse the filesystem outside the archive boundary.\nExploitation prerequisites are minimal: the attacker requires network access to the legacy 1.x API endpoints exposed by the Metacat deployment. No valid user session, authentication credentials, or elevated privileges are necessary. The payload behavior leverages directory traversal patterns to access arbitrary files readable by the underlying Tomcat system user.\nPost-exploitation impact is critical. Successful file retrieval exposes sensitive assets including system and application credentials, client certificates, and cryptographic private keys. Exfiltration of these cryptographic materials permits an attacker to impersonate legitimate member nodes within the DataONE federation. Additionally, adversaries can access embargoed research data and conduct comprehensive system reconnaissance to facilitate further compromise. The vulnerability persists in version 2.19.1 due to identical vulnerable code, and the 2.x branch is unsupported for backported security fixes."
}