CVE-2026-49831
MediumCVSS 5.5Summary
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, in the Curation Task feature allows an output path to be used by the reporter (-r parameter) without restricting it to a base path. This means any path writable by the DSpace (often 'tomcat') user is allowed, constituting a path traversal vulnerability in the curate script.
Risk Assessment
A user with permission to run curation tasks could write files to arbitrary locations on the file system, potentially overwriting important files or placing malicious content. This could compromise system integrity.
Recommendation
Upgrade DSpace to versions 7.6.7, 8.4, 9.3, or 10.0 where the vulnerability is fixed. Additionally, restrict permissions to run the curate script to trusted administrators only.
Other vulnerabilities in DSpace
See all- CVE-2026-49833Medium
DSpace, a repository application, in versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, has a path traversal vulnerability via the COAR Notify / LDN service. The attacker must already have DSpace administrator credentials. When reading a file input stream of an inbound pattern/template used to generate an LDN message, the LDN class does not check for path traversal or restrict templates to a known base path. This could allow reading and interpreting an untrusted file from elsewhere in the file system as an Apache Velocity template.
- CVE-2026-49832High
DSpace versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 allow Remote Code Execution (RCE) via Velocity Templates used for COAR Notify/LDN messages. Patched in versions 8.4, 9.3, and 10.0.
- CVE-2026-49830Medium
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow local file inclusion via malicious paths like file:///etc/passwd. The attacker must already have DSpace collection administrator privileges.
Original NVD description (English source)
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.