org.dspace:dspace-jspui-api (1.5.0), org.dspace:dspace-jspui-webapp (1.5.0) +8 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.5.0)

org.dspace:dspace-api MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.0 - org.dspace:dspace-jspui-webapp 1.5.0 - org.dspace:dspace-lni-core 1.5.0 -...

org.dspace:dspace-jspui-api (1.5.1-beta), org.dspace:dspace-jspui-webapp (1.5.1-beta) +8 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.5.1-beta)

org.dspace:dspace-api MAVEN version 1.5.1-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.1-beta - org.dspace:dspace-jspui-webapp 1.5.1-beta - org.dspace:dspace-lni-core...

org.dspace:dspace-discovery-provider (1.7.0-rc1), org.dspace:dspace-discovery-xmlui-api (1.7.0-rc1) +13 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.7.0-rc1)

org.dspace:dspace-api MAVEN version 1.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-discovery-provider 1.7.0-rc1 - org.dspace:dspace-discovery-xmlui-api 1.7.0-rc1 -...

org.dspace.modules:jspui (1.7.0), org.dspace.modules:lni (1.7.0) +19 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.7.0)

org.dspace:dspace-api MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:jspui 1.7.0 - org.dspace.modules:lni 1.7.0 - org.dspace.modules:oai 1.7.0 - org.dspace.modules:swo...

org.dspace.modules:jspui (1.7.2), org.dspace.modules:lni (1.7.2) +19 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.7.2)

org.dspace:dspace-api MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:jspui 1.7.2 - org.dspace.modules:lni 1.7.2 - org.dspace.modules:oai 1.7.2 - org.dspace.modules:swo...

org.dspace.modules:jspui (1.8.0-rc3), org.dspace.modules:lni (1.8.0-rc3) +25 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.8.0-rc3)

org.dspace:dspace-api MAVEN version 1.8.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:jspui 1.8.0-rc3 - org.dspace.modules:lni 1.8.0-rc3 - org.dspace.modules:oai 1.8.0-rc3 -...

CVE-2022-31193

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

CVE-2022-31194

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowi...

DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import

Impact ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible...

GHSA-8RMH-55H4-93H5 DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import

Impact ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible...

de.the-library-code.dspace:addon-duplication-detection-service-api (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1) +18 more potentially affected by CVE-2022-31195 via org.dspace:dspace-api (>=6.0, <=6.3)

org.dspace:dspace-api MAVEN version =6.0, =6.2.0, =6.2.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.0, =6.3 and more Source cves: CVE-2022-31195 Source advisory: OSV:GHSA-8RMH-55H4-93H5...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31194 Source advisory: OSV:GHSA-QP5M-C3M9-8Q2P...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31194 Source advisory: GHSA-QP5M-C3M9-8Q2P...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31194 Source advisory: OSV:GHSA-QP5M-C3M9-8Q2P...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31194 Source advisory: GHSA-QP5M-C3M9-8Q2P...

JSPUI vulnerable to path traversal in submission (resumable) upload

Impact The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, by modifying some request parameters durin...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31193 Source advisory: OSV:GHSA-763J-Q7WV-VF3M...

de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (5.8.0), org.dspace.modules:jspui (>=4.0, <=5.10) potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=4.0, <=5.10)

org.dspace:dspace-jspui MAVEN version =4.0, =4.0, =5.10 Source cves: CVE-2022-31193 Source advisory: GHSA-763J-Q7WV-VF3M...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31193 Source advisory: OSV:GHSA-763J-Q7WV-VF3M...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (6.3.0) +1 more potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=6.0, <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31193 Source advisory: GHSA-763J-Q7WV-VF3M...