TI-2016-08766 Aliases CVE-2016-10726 GHSA-4m9r-5gqp-7j82

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows…

LOW 38CWE-22Published 2018-07-10 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Why it matters now

EPSS 0.02892 86th percentileScored 2026-11-07

Fix Fixed org.dspace:dspace-xmlui (Maven): 4.5, 5.5, 3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.dspace:dspace-xmlui (Maven)	4.0 to before 4.5	4.5	Patch available	GHSA-4m9r-5gqp-7j82
—	org.dspace:dspace-xmlui (Maven)	5.0 to before 5.5	5.5	Patch available	GHSA-4m9r-5gqp-7j82
—	org.dspace:dspace-xmlui (Maven)	before 3.6	3.6	Patch available	GHSA-4m9r-5gqp-7j82

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.dspace:dspace-xmlui (Maven) Vendor— Affected 4.0 to before 4.5 Fixed in 4.5 Patch available GHSA-4m9r-5gqp-7j82
org.dspace:dspace-xmlui (Maven) Vendor— Affected 5.0 to before 5.5 Fixed in 5.5 Patch available GHSA-4m9r-5gqp-7j82
org.dspace:dspace-xmlui (Maven) Vendor— Affected before 3.6 Fixed in 3.6 Patch available GHSA-4m9r-5gqp-7j82

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:duraspace:dspace::::::::	before 3.6; 4.0 to before 4.5; 5.0 to before 5.5	Vulnerable	DSpace

cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:* Versions before 3.6; 4.0 to before 4.5; 5.0 to before 5.5 Vulnerable ·DSpace

Remediation

Fix · GHSA-4m9r-5gqp-7j82 org.dspace:dspace-xmlui (Maven) Fixed in 4.5 Advisory →
Fix · GHSA-4m9r-5gqp-7j82 org.dspace:dspace-xmlui (Maven) Fixed in 5.5 Advisory →
Fix · GHSA-4m9r-5gqp-7j82 org.dspace:dspace-xmlui (Maven) Fixed in 3.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2016-10726
2026-10-03 Alias added: GHSA-4m9r-5gqp-7j82

References

Patch 1

https://jira.duraspace.org/browse/DS-3094

Advisory 4

TI-2022-13234 Path traversal vulnerabilities in DSpace JSPUI submission upload CVSS 3.1HIGH 8.2
TI-2022-13235 Path traversal vulnerability in Simple Archive Format package import in DSpace CVSS 3.1HIGH 7.2
TI-2021-18028 Communities and collections administrators can escalate their privilege up to system administrator CVSS 3.1HIGH 7.2
TI-2022-13233 URL Redirection to Untrusted Site in Dspace JSPUI CVSS 3.1HIGH 7.1
TI-2022-13232 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature CVSS 3.1HIGH 7.1
TI-2022-13231 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools CVSS 3.1HIGH 7.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences