org.dspace/dspace-api vulnerabilities

Latest org.dspace/dspace-api CVEs

Newest publication first

1. CVE-2026-49832 DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

   Published 2026-09-02

   High·CVSS 8.0 EPSS 0.87%

   DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for C...

2. CVE-2026-49833 DSpace: Path Traversal possible in LDN message generation

   Published 2026-09-02

   Medium·CVSS 5.5 EPSS 0.37%

   DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpac...

3. CVE-2026-49831 DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)

   Published 2026-09-02

   Medium·CVSS 5.5 EPSS 0.53%

   DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and...

4. CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources

   Published 2026-09-02

   Medium·CVSS 4.4 EPSS 0.49%

   DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate t...

5. CVE-2025-53622 DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file

   Published 2025-07-15

   Medium·CVSS 5.2 EPSS 0.48%

   DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, and 9.1, a path traversal vulnerability is possible during the import of an archive (in Simple Archive Format), either from command-line (./ds...

6. CVE-2025-53621 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

   Published 2025-07-15

   Medium·CVSS 6.9 EPSS 0.44%

   DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XM...

7. CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace

   Published 2022-08-01

   High·CVSS 7.2 EPSS 2.0%

   DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a fil...

8. CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator

   Published 2021-10-29

   High·CVSS 7.2 EPSS 2.1%

   DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in ver...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.