org.dspace.modules:xmlui (>=3.0-rc1, <=3.5) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=3.0-rc1, <=3.5)

org.dspace:dspace-xmlui MAVEN version =3.0-rc1, =3.0-rc1, =3.5 Source cves: CVE-2016-10726 Source advisory: MEND:CVE-2016-10726...

PT-2018-4892

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 3.6 DSpace versions 4.x prior to 4.5 DSpace versions 5.x prior to 5.5 Description The issue allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a...

CVE-2016-10726: Improper Limitation of a Pathname to a Restricted Directory

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...