CVE-2026-73975

HighCVSS 8.4

Published: 01/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

djehuty, a research data repository system, prior to version 26.3.2, allows an authenticated depositor to inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in the RDF store. This compromises the integrity of the whole repository's metadata.

Risk Assessment

An attacker with an account can compromise the integrity of metadata for all data in the repository, potentially leading to loss of trust in the system and falsification of research data.

Recommendation

Update djehuty to version 26.3.2 or later, which includes the fix.

Other vulnerabilities in djehuty

CVE-2026-73976High
djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

Original NVD description (English source)

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS