Approved changes feed: RSS · Atom

cpe:2.3:a:geopython:pygeoapi:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGeopython (1e90dbb1-836b-5bdd-9eba-f5c1e7e881d8)
ProductPygeoapi (e7944e39-2242-5f83-89fd-7a5e3b7e516a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-42352 vulnerable 2026-06-08 08:03:16.203811 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
HIGH (8.6)
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.
Published: 2026-05-08T22:31:50.110Z
Updated: 2026-05-11T17:56:10.795Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-42351 vulnerable 2026-06-08 08:03:16.203374 pygeoapi: Path Traversal in STAC FileSystemProvider
HIGH (7.5)
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.
Published: 2026-05-08T22:31:18.001Z
Updated: 2026-05-12T02:13:37.972Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.