CVE-2026-49831 json
DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
published 2026-07-08 4 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-70234 , GHSA-v66x-68f2-pxf5
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
Patch / fix
- maven org.dspace:dspace-api 7.6.7, 8.4, 9.3, 10.0
- duraspace dspace 7.6.7, 8.4, 9.3
- org.dspace dspace-api 7.6.7, 8.4, 9.3
- github.com/DSpace/DSpace#12539 pull request
- github.com/DSpace/DSpace#12540 pull request
- github.com/DSpace/DSpace#12552 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.dspace:dspace-api | <7.6.7 >=8.0-rc1, <8.4 >=9.0-rc1, <9.3 >=10-rc1, <10.0 |
7.6.7 8.4 9.3 10.0 |
Affected products
- DSpace DSpace
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
Sources
- CVE List CVE-2026-49831
- GitHub Advisory GHSA-v66x-68f2-pxf5
- NVD CVE-2026-49831
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.