Dspace vulnerabilities

Products

• Dspace 15

Newest

• dspace DSpace: Path Traversal possible in LDN message generation CVE-2026-49833 Fix available 5.5 MediumJuly 8, 2026
• dspace DSpace: ORE resource URI does not validate scheme for non-web resources CVE-2026-49830 Fix available 4.4 MediumJuly 8, 2026
• dspace DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) CVE-2026-49831 Fix available 5.5 MediumJuly 8, 2026
• dspace DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN CVE-2026-49832 Fix available 8.0 HighJuly 8, 2026
• dspace DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file CVE-2025-53622 Fix available 5.2 MediumJuly 15, 2025
• dspace DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources CVE-2025-53621 Fix available 6.9 MediumJuly 15, 2025
• dspace DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document CVE-2024-38364 Fix available 2.6 LowJune 25, 2024
• dspace Path traversal vulnerability in Simple Archive Format package import in DSpace CVE-2022-31195 Public exploitFix available 7.2 HighAugust 1, 2022
• dspace Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature CVE-2022-31192 Public exploitFix available 7.1 HighAugust 1, 2022
• dspace Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools CVE-2022-31191 Fix available 7.1 HighAugust 1, 2022
• dspace Path traversal vulnerabilities in DSpace JSPUI submission upload CVE-2022-31194 Public exploitFix available 8.2 HighAugust 1, 2022
• dspace URL Redirection to Untrusted Site in Dspace JSPUI CVE-2022-31193 Fix available 7.1 HighAugust 1, 2022
• dspace "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization CVE-2022-31189 Fix available 5.3 MediumAugust 1, 2022
• dspace Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI CVE-2022-31190 Fix available 5.3 MediumAugust 1, 2022
• dspace Communities and collections administrators can escalate their privilege up to system administrator CVE-2021-41189 Fix available 7.2 HighOctober 29, 2021