https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:56:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-49830 <p>DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.</p> <p>DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-49830 https://db.gcve.eu/vuln/ghsa-c827-pw3m-67w7 <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>When ingesting an aggregated ORE resource by URI (using the [OAI-ORE Harvester](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125906/OAI#OAI-OAI-PMH/OAI-OREHarvester(Client))), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like `file:///etc/passwd`. _This vulnerability impacts DSpace versions &lt;= 7.6.6, 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace collection administrator privileges in order to perform the attack.</p> <p>Expected behaviour : Only external web resources should be ingested as ORE resources, preferably from the trusted endpoint.</p> <p>## Impact</p> <p>A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream.</p> <p>Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML.</p> <p>## Patches</p> <p>The fix is included in DSpace 7.6.7, 8.4, 9.3 and 10.0. Please upgrade to one of these versions or disable the ORE Crosswalk (see below).</p> <p>If users cannot upgrade immediately, it is possible to manually patch their DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.x. * Pull request…</p> <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>When ingesting an aggregated ORE resource by URI (using the [OAI-ORE Harvester](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125906/OAI#OAI-OAI-PMH/OAI-OREHarvester(Client))), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like `file:///etc/passwd`. _This vulnerability impacts DSpace versions &lt;= 7.6.6, 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace collection administrator privileges in order to perform the attack.</p> <p>Expected behaviour : Only external web resources should be ingested as ORE resources, preferably from the trusted endpoint.</p> <p>## Impact</p> <p>A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream.</p> <p>Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML.</p> <p>## Patches</p> <p>The fix is included in DSpace 7.6.7, 8.4, 9.3 and 10.0. Please upgrade to one of these versions or disable the ORE Crosswalk (see below).</p> <p>If users cannot upgrade immediately, it is possible to manually patch their DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.x. * Pull request…</p> https://db.gcve.eu/vuln/ghsa-c827-pw3m-67w7