- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 3 high, 5 medium
- Dependents
- 10
- Registry
- Maven Central
Advisories 8
- CVE-2026-49832High 8.0
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
Affected: from 8.0-rc1, fixed in 8.4; from 9.0-rc1, fixed in 9.3; from 10.0-rc1, fixed in 10.0.
- CVE-2026-49833Medium 5.5
DSpace: Path Traversal possible in LDN message generation
Affected: from 8.0-rc1, fixed in 8.4; from 9.0-rc1, fixed in 9.3; from 10.0-rc1, fixed in 10.0.
- CVE-2026-49831Medium 5.5
DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
Affected: fixed in 7.6.7; from 8.0-rc1, fixed in 8.4; from 9.0-rc1, fixed in 9.3; from 10-rc1, fixed in 10.0.
- CVE-2026-49830Medium 4.4
DSpace: ORE resource URI does not validate scheme for non-web resources
Affected: fixed in 7.6.7; from 8.0-rc1, fixed in 8.4; from 9.0-rc1, fixed in 9.3; from 10-rc1, fixed in 10.0.
- CVE-2025-53622Medium 5.2
DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file
Affected: fixed in 7.6.4; from 8.0, fixed in 8.2; from 9.0, fixed in 9.1.
- CVE-2025-53621Medium 6.9
DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources
Affected: fixed in 7.6.4; from 8.0, fixed in 8.2; from 9.0, fixed in 9.1.
- CVE-2022-31195High 7.2
Path traversal vulnerability in Simple Archive Format package import in DSpace
Affected: from 4.0, fixed in 5.11; from 6.0, fixed in 6.4.
- CVE-2021-41189High 7.2
Communities and collections administrators can escalate their privilege up to system administrator
Affected: from 7.0, fixed in 7.1.