Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-49831DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)

Medium 5.5

In plain English

A medium-severity path traversal in DSpace from DSpace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.5%top 55.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.dspace:dspace-api7.6.7GHSA-v66x-68f2-pxf5
Mavenorg.dspace:dspace-api8.4GHSA-v66x-68f2-pxf5
Mavenorg.dspace:dspace-api9.3GHSA-v66x-68f2-pxf5
Mavenorg.dspace:dspace-api10.0GHSA-v66x-68f2-pxf5

Affected products (as reported)

VendorProductVersions
DSpace DSpace < 7.6.7>= 8.0-rc1, < 8.4>= 9.0-rc1, < 9.3= 10-rc1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

References