Read the docs
TI-2026-51980 Aliases CVE-2026-73975

djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples

Priority HIGH 70CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed djehuty (4TUResearchData): 26.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
4TUResearchDatadjehutybefore 26.3.226.3.2Patch availableCNA
  • djehuty Vendor4TUResearchData Affected before 26.3.2 Fixed in 26.3.2 Patch available CNA

Remediation

  • Fix · CNA djehuty (4TUResearchData) Fixed in 26.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73975
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: LOW → HIGH

References

Other 2

  • TI-2026-51981 djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`) CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences