pygeoapi vulnerabilities

2 known vulnerabilities in pygeoapi from Geopython. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  pygeoapi: Server-Side Request Forgery

  CVE-2026-42352May 8, 2026Geopython

  pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in v

• 7.5 High severity

  pygeoapi: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-42351May 8, 2026Geopython

  pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection bas