CVE-2026-49831

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation...

CVE-2026-49831 DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation...

CVE-2026-49831

CVE-2026-49831 is a Path Traversal vulnerability in the DSpace Curation Task feature. The curate script's reporter output path (-r parameter) is not restricted to a configured base directory, allowing any path writable by the DSpace (typically tomcat) user. An attacker with Collection/Community/S...

DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

Overview The Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace often 'tomcat' user is allowed...

GHSA-V66X-68F2-PXF5 DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

Overview The Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace often 'tomcat' user is allowed...