An unauthenticated path traversal vulnerability in pygeoapi exposes server directories, posing a high risk to data confidentiality.

This is a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, allowing unauthenticated attackers to access arbitrary directories.

Successful exploitation of this vulnerability allows unauthorized users to read sensitive files and expose directory structures on the host system. This leads to a breach of data confidentiality and potential exposure of internal application secrets. The CVSS score of 7.5 reflects a high severity threat due to the network attack vector and the lack of required authentication.

Immediate Action: Update pygeoapi to version 0.23.3 or later as provided in the vendor security advisory.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal sequences such as dot-dot-slash patterns targeting STAC collection endpoints.

Compensating Controls: Deploy a reverse proxy or web front end in front of pygeoapi to normalize incoming URLs and block requests containing directory traversal sequences.

Public Exploit Available: No

Organizations running vulnerable versions of pygeoapi should apply the available security update to version 0.23.3 immediately. Prioritize patching internet-facing deployments lacking a normalizing reverse proxy to eliminate unauthorized file access risks.