Metacat’s Solr indexing component forwards a client‑controlled query type parameter through SolrJ to its backend. An unauthenticated client can request the /admin/file handler, and SolrJ rewrites the request so that it succeeds even when handleSelect is disabled. The backend then returns configuration files such as solrconfig.xml. Metacat embeds the file contents in an XML error response, exposing internal Solr configuration and enabling infrastructure profiling. The weakness is a privilege escalation for internal configuration disclosure, classified as CWE‑441.

NCEAS Metacat installations running any version earlier than 3.4.2 are vulnerable. The flaw originates in the MetacatSolrIndex.query code. Administrators should verify the installed version and refer to the release notes for patch information.

The CVSS score of 5.8 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. An attacker can leverage the flaw remotely over the network using an unauthenticated request; no special privileges or access are required. Because the exposed data is configuration files, an attacker can conduct infrastructure profiling or plan further attacks.