DSpace: Path Traversal is possible through LDN message generation

Overview A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an...

DSpace: ORE resource URI does not validate scheme for non-web resources

Overview When ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. This vulnerability impacts DSpace versions = 7.6.6, 8.0 = 8.3,...

PT-2026-56678

Name of the Vulnerable Software and Affected Versions DSpace versions 8.0-rc1 through 8.3 DSpace versions 9.0-rc1 through 9.2 DSpace versions 10-rc1 through 10.0-rc1 Description A path traversal issue exists in the COAR Notify / LDN service. An attacker with DSpace administrator credentials can...

PT-2025-29566 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 7.6.4 DSpace versions prior to 8.2 DSpace versions prior to 9.1 Description: DSpace is a repository application that provides durable access to digital resources. Two related XML External Entity XXE injection...

DSpace path traversal vulnerability

DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions prior to 7.6.4, prior to 8.2, and prior to 9.1, which stems from a path traversal vulnerability that could lead to the disclosure of sensitive information...

PT-2022-20600 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not...