https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:19:44 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-49831 <p>DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often &#39;tomcat&#39;) user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.</p> <p>DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often &#39;tomcat&#39;) user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-49831 https://db.gcve.eu/vuln/ghsa-v66x-68f2-pxf5 <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows an output path to be used by the reporter (`-r` parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often &#39;tomcat&#39;) user is allowed. This constitutes a Path Traversal Vulnerability in the `curate` script.</p> <p>This was not a real problem when curation tasks could only be run from the command-line as a system administrator, but now that Collection/Community/Site Administrators can also run curation tasks via the web user interface, it introduces a possibility for an attacker with DSpace administrative credentials to set command parameters in such a way that output ends up in an unexpected location (for example, static resources folder in the Spring boot webapp, or overwriting a configuration file).</p> <p>_This vulnerability impacts DSpace versions &lt;= 7.6.6, 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace Collection/Community/Site Administrator credentials in order to perform the attack.</p> <p>Expected behaviour : Only a set of configured output directories should be allowed as base paths for Curation reporter output. The fix applied here is designed to be used with other systems that need to read or write streams on disk. In addition, we do not see a need for the web-managed processes to allow the `-r` reporter output parameter a…</p> <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows an output path to be used by the reporter (`-r` parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often &#39;tomcat&#39;) user is allowed. This constitutes a Path Traversal Vulnerability in the `curate` script.</p> <p>This was not a real problem when curation tasks could only be run from the command-line as a system administrator, but now that Collection/Community/Site Administrators can also run curation tasks via the web user interface, it introduces a possibility for an attacker with DSpace administrative credentials to set command parameters in such a way that output ends up in an unexpected location (for example, static resources folder in the Spring boot webapp, or overwriting a configuration file).</p> <p>_This vulnerability impacts DSpace versions &lt;= 7.6.6, 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace Collection/Community/Site Administrator credentials in order to perform the attack.</p> <p>Expected behaviour : Only a set of configured output directories should be allowed as base paths for Curation reporter output. The fix applied here is designed to be used with other systems that need to read or write streams on disk. In addition, we do not see a need for the web-managed processes to allow the `-r` reporter output parameter a…</p> https://db.gcve.eu/vuln/ghsa-v66x-68f2-pxf5