org.dspace:dspace-jspui-api (1.5.2), org.dspace:dspace-jspui-webapp (1.5.2) +8 more potentially affected by CVE-2026-49830 via org.dspace:dspace-api (1.5.2)

org.dspace:dspace-api MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.2 - org.dspace:dspace-jspui-webapp 1.5.2 - org.dspace:dspace-lni-core 1.5.2 -...

org.dspace:dspace-jspui-api (1.5.0), org.dspace:dspace-jspui-webapp (1.5.0) +8 more potentially affected by CVE-2026-49830 via org.dspace:dspace-api (1.5.0)

org.dspace:dspace-api MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.0 - org.dspace:dspace-jspui-webapp 1.5.0 - org.dspace:dspace-lni-core 1.5.0 -...

org.dspace.modules:additions (3.1), org.dspace.modules:jspui (3.1) +12 more potentially affected by CVE-2026-49830 via org.dspace:dspace-api (3.1)

org.dspace:dspace-api MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:additions 3.1 - org.dspace.modules:jspui 3.1 - org.dspace.modules:lni 3.1 - org.dspace.modules:oai 3...

org.dspace:dspace-jspui-api (1.6.1), org.dspace:dspace-jspui-webapp (1.6.1) +9 more potentially affected by CVE-2025-53622 via org.dspace:dspace-api (1.6.1)

org.dspace:dspace-api MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.6.1 - org.dspace:dspace-jspui-webapp 1.6.1 - org.dspace:dspace-lni-core 1.6.1 -...

org.dspace.modules:additions (3.0-rc3), org.dspace.modules:jspui (3.0-rc3) +12 more potentially affected by CVE-2025-53622 via org.dspace:dspace-api (3.0-rc3)

org.dspace:dspace-api MAVEN version 3.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:additions 3.0-rc3 - org.dspace.modules:jspui 3.0-rc3 - org.dspace.modules:lni 3.0-rc3 -...

org.dspace:dspace-jspui-api (1.5.2), org.dspace:dspace-jspui-webapp (1.5.2) +8 more potentially affected by CVE-2025-53622 via org.dspace:dspace-api (1.5.2)

org.dspace:dspace-api MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.2 - org.dspace:dspace-jspui-webapp 1.5.2 - org.dspace:dspace-lni-core 1.5.2 -...

org.dspace:dspace-jspui-api (1.5.2-rc1), org.dspace:dspace-jspui-webapp (1.5.2-rc1) +8 more potentially affected by CVE-2025-53622 via org.dspace:dspace-api (1.5.2-rc1)

org.dspace:dspace-api MAVEN version 1.5.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.2-rc1 - org.dspace:dspace-jspui-webapp 1.5.2-rc1 - org.dspace:dspace-lni-core...

org.dspace:dspace (1.5-alpha), org.dspace:dspace-jspui (1.5-alpha) +10 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.5-alpha)

org.dspace:dspace-api MAVEN version 1.5-alpha is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace 1.5-alpha - org.dspace:dspace-jspui 1.5-alpha - org.dspace:dspace-lni 1.5-alpha -...

org.dspace:dspace-jspui-api (1.5.0-beta1), org.dspace:dspace-jspui-webapp (1.5.0-beta1) +10 more potentially affected by CVE-2025-53621 via org.dspace:dspace-api (1.5.0-beta1)

org.dspace:dspace-api MAVEN version 1.5.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.5.0-beta1 - org.dspace:dspace-jspui-webapp 1.5.0-beta1 -...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=4.0, <=6.3) potentially affected by CVE-2022-31190 via org.dspace:dspace-xmlui (>=4.0, <=6.3)

org.dspace:dspace-xmlui MAVEN version =4.0, =5.4.0, =4.0, =6.3 Source cves: CVE-2022-31190 Source advisory: OSV:GHSA-7W85-PP86-P4PQ...

Information Disclosure

dspace-xmlui is vulnerable to information disclosure. The vulnerability exists because the generate function of DSpaceMETSGenerator.java does not properly check the read permissions for METS values, allowing an attacker to gain sensitive information through the XMLUI mets.xml object...

CVE-2022-31190

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=4.0, <=6.3) potentially affected by CVE-2022-31190 via org.dspace:dspace-xmlui (>=4.0, <=6.3)

org.dspace:dspace-xmlui MAVEN version =4.0, =5.4.0, =4.0, =6.3 Source cves: CVE-2022-31190 Source advisory: MEND:CVE-2022-31190...

CVE-2022-31190

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

CVE-2022-31190: Exposure of Sensitive Information to an Unauthorized Actor

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=5.0, <=5.4) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=5.0, <=5.4)

org.dspace:dspace-xmlui MAVEN version =5.0, =5.4.0, =5.0, =5.4 Source cves: CVE-2016-10726 Source advisory: OSV:GHSA-4M9R-5GQP-7J82...

org.dspace.modules:xmlui (>=3.0-rc1, <=3.5) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=3.0-rc1, <=3.5)

org.dspace:dspace-xmlui MAVEN version =3.0-rc1, =3.0-rc1, =3.5 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...

GHSA-4M9R-5GQP-7J82 High severity vulnerability that affects org.dspace:dspace-xmlui

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

org.dspace.modules:xmlui (>=4.0, <=4.1) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=4.0, <=4.1)

org.dspace:dspace-xmlui MAVEN version =4.0, =4.0, =4.1 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=5.0, <=5.4) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=5.0, <=5.4)

org.dspace:dspace-xmlui MAVEN version =5.0, =5.4.0, =5.0, =5.4 Source cves: CVE-2016-10726 Source advisory: GHSA-4M9R-5GQP-7J82...