https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:56:54 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-49833 <p>DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an &#34;inbound pattern&#34; / &#34;template&#34;, used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.</p> <p>DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an &#34;inbound pattern&#34; / &#34;template&#34;, used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-49833 https://db.gcve.eu/vuln/ghsa-9qm4-rh6w-pq5x <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126679/COAR+Notify) service in DSpace. _This vulnerability impacts DSpace versions 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace administrator credentials in order to perform the attack.</p> <p>When reading a file input stream of an &#34;inbound pattern&#34; / &#34;template&#34;, used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template.</p> <p>Expected behaviour : Only the trusted templates kept in `$dspace.dir/config/ldn` should be allowed or used by LDN.</p> <p>## Impact</p> <p>On its own this seems a fairly low-impact problem: only DSpace Administrators can set LDN template names in services, and you typically need more access to manipulate files on the server.</p> <p>However, this vulnerability was included as part of an attack chain that demonstrated the ability of a DSpace Administrator to put the malicious Velocity payload in a predictable place (e.g. temporary log file from a running process) and then have that file referenced as the template name in a new service. This means it is possible (non-trivial, but proven) for an attacker with DSpace administrator credentials to either disclose information via a spec…</p> <p><strong>Affected:</strong> Maven: org.dspace:dspace-api</p> <p>## Overview</p> <p>A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126679/COAR+Notify) service in DSpace. _This vulnerability impacts DSpace versions 8.0 &lt;= 8.3, 9.0 &lt;= 9.2._ The attacker MUST already have DSpace administrator credentials in order to perform the attack.</p> <p>When reading a file input stream of an &#34;inbound pattern&#34; / &#34;template&#34;, used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template.</p> <p>Expected behaviour : Only the trusted templates kept in `$dspace.dir/config/ldn` should be allowed or used by LDN.</p> <p>## Impact</p> <p>On its own this seems a fairly low-impact problem: only DSpace Administrators can set LDN template names in services, and you typically need more access to manipulate files on the server.</p> <p>However, this vulnerability was included as part of an attack chain that demonstrated the ability of a DSpace Administrator to put the malicious Velocity payload in a predictable place (e.g. temporary log file from a running process) and then have that file referenced as the template name in a new service. This means it is possible (non-trivial, but proven) for an attacker with DSpace administrator credentials to either disclose information via a spec…</p> https://db.gcve.eu/vuln/ghsa-9qm4-rh6w-pq5x