CVE-2026-49831

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/DSpace/DSpace/pull/12539
https://github.com/DSpace/DSpace/pull/12540
https://github.com/DSpace/DSpace/pull/12552
https://github.com/DSpace/DSpace/security/advisories/GHSA-v66x-68f2-pxf5

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-02 18:19

Updated : 2026-09-09 21:05

NVD link : CVE-2026-49831

Mitre link : CVE-2026-49831

CVE.ORG link : CVE-2026-49831

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-49831", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49831", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T19:01:23.911474Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "DSpace", "product": "DSpace", "versions": [{"status": "affected", "version": "< 7.6.7"}, {"status": "affected", "version": ">= 8.0-rc1, < 8.4"}, {"status": "affected", "version": ">= 9.0-rc1, < 9.3"}, {"status": "affected", "version": "= 10-rc1"}]}]}], "published": "2026-09-02T18:19:32.683", "references": [{"url": "https://github.com/DSpace/DSpace/pull/12539", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/12540", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/12552", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-v66x-68f2-pxf5", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0."}], "lastModified": "2026-09-09T21:05:23.237", "sourceIdentifier": "security-advisories@github.com"}