Vulnerabilities

TI-2026-36736 CVE-2026-49832 · GHSA-9x82-rm84-c6x7

DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

LOW 38

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00869 Published 2026-09-02 Fixed in 8.4, 9.3 +1 CWE-94

TI-2026-36737 CVE-2026-49833 · GHSA-9qm4-rh6w-pq5x

DSpace: Path Traversal possible in LDN message generation

LOW 25

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.0037 Published 2026-09-02 Fixed in 8.4, 9.3 +1 CWE-22

TI-2026-36735 CVE-2026-49831 · GHSA-v66x-68f2-pxf5

DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)

LOW 25

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00527 Published 2026-09-02 Fixed in 7.6.7, 8.4 +2 CWE-22

TI-2026-36734 CVE-2026-49830 · GHSA-c827-pw3m-67w7

DSpace: ORE resource URI does not validate scheme for non-web resources

LOW 21

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00489 Published 2026-09-02 Fixed in 7.6.7, 8.4 +2 CWE-20

TI-2025-33549 CVE-2025-53622 · GHSA-vhvx-8xgc-99wf

DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file

LOW 24

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.0048 Published 2025-07-15 Fixed in 7.6.4, 8.2 +1 CWE-22

TI-2025-33548 CVE-2025-53621 · GHSA-jjwr-5cfh-7xwh

XML external entity injection in DSpace

LOW 31

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00436 Published 2025-07-15 Fixed in 7.6.4, 8.2 +1 CWE-611

TI-2024-25621 CVE-2024-38364 · GHSA-94cc-xjxr-pwvf

DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

LOW 13

DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources.

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.00393 Published 2024-06-25 Fixed in 7.6.2 CWE-79

TI-2022-13235 CVE-2022-31195 · GHSA-8rmh-55h4-93h5

Path traversal vulnerability in Simple Archive Format package import in DSpace

LOW 38

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01968 Published 2022-08-01 Fixed in 6.4, 5.11 CWE-22

TI-2022-13232 CVE-2022-31192 · GHSA-4wm8-c2vv-xrpq

Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

LOW 33

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00791 Published 2022-08-01 Fixed in 6.4, 5.11 CWE-79

TI-2022-13231 CVE-2022-31191 · GHSA-c558-5gfm-p2r8

Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

LOW 33

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00808 Published 2022-08-01 Fixed in 6.4, 5.11 CWE-79

TI-2022-13234 CVE-2022-31194 · GHSA-qp5m-c3m9-8q2p

Path traversal vulnerabilities in DSpace JSPUI submission upload

LOW 39

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 8.2 Network High privileges No interaction EPSS 0.01464 Published 2022-08-01 Fixed in 6.4, 5.11 CWE-22

TI-2022-13233 CVE-2022-31193 · GHSA-763j-q7wv-vf3m

URL Redirection to Untrusted Site in Dspace JSPUI

LOW 33

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00885 Published 2022-08-01 Fixed in 6.4, 5.11 CWE-601

TI-2022-13229 CVE-2022-31189 · GHSA-c2j7-66m3-r4ff

"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

LOW 31

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00723 Published 2022-08-01 Fixed in 6.4 CWE-209

TI-2022-13230 CVE-2022-31190 · GHSA-7w85-pp86-p4pq

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

LOW 32

DSpace open source software is a repository application which provides durable access to digital resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00921 Published 2022-08-01 Fixed in 6.4 CWE-200

TI-2021-18028 CVE-2021-41189 · GHSA-cf2j-vf36-c6w8

Communities and collections administrators can escalate their privilege up to system administrator

LOW 36

DSpace is an open source turnkey repository application.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02056 Published 2021-10-29 Fixed in 7.1 CWE-863

TI-2019-04922 CVE-2019-6986 · GHSA-hgq9-q8g2-3jmg

SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary…

LOW 38

SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20reg…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03016 Published 2019-01-28 Fixed in 1.11.0 CWE-400

TI-2016-08766 CVE-2016-10726 · GHSA-4m9r-5gqp-7j82

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows…

LOW 38

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02892 Published 2018-07-10 Fixed in 4.5, 5.5 +1 CWE-22

Vulnerabilities

Filters