CVE-2026-73976

HighCVSS 7.1

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

27th percentile - higher than 27% of all known CVEs

Summary

djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

Risk Assessment

An attacker can access private data stored in the RDF store and cause service unavailability.

Recommendation

Upgrade djehuty to version 26.3.2 or later, which includes the fix.

Other vulnerabilities in djehuty

CVE-2026-73975High
djehuty, a research data repository system, prior to version 26.3.2, allows an authenticated depositor to inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in the RDF store. This compromises the integrity of the whole repository's metadata.

Original NVD description (English source)

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS