Skip to content
Fencer Vulns
high 8.2

CVE-2022-31194 json

Path traversal vulnerabilities in DSpace JSPUI submission upload

published 2022-08-01 4 y ago modified 2026-06-17 4 mo ago also GHSA-qp5m-c3m9-8q2p , EUVD-2022-6608

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, by modifying some request parameters during submission. This path traversal can only be executed by a user with special privileges (submitter rights). This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds. However, this vulnerability cannot be exploited by an anonymous user or a basic user. The user must first have submitter privileges to at least one Collection and be able to determine how to modify the request parameters to exploit the vulnerability.

Patch / fix

  • maven org.dspace:dspace-jspui 5.11, 6.4
  • duraspace dspace 6.4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Affected packages

ecosystem package affected fixed in
maven org.dspace:dspace-jspui
>=4.0, <5.11
>=6.0, <6.4
5.11
6.4

Affected products

  • DSpace DSpace

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.