DSpace vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20227
3. 20241
4. 20252
5. 20264

Newest CVEs

• CVE-2026-49832

  DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

  DSpace · DSpace

  High8.0
• CVE-2026-49833

  DSpace: Path Traversal possible in LDN message generation

  DSpace · DSpace

  Medium5.5
• CVE-2026-49831

  DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)

  DSpace · DSpace

  Medium5.5
• CVE-2026-49830

  DSpace: ORE resource URI does not validate scheme for non-web resources

  DSpace · DSpace

  Medium4.4
• CVE-2025-53622

  DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file

  DSpace · DSpace

  Medium5.2
• CVE-2025-53621

  DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

  DSpace · DSpace

  Medium6.9
• CVE-2024-38364

  DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

  DSpace · DSpace

  Low2.6
• CVE-2022-31195

  Path traversal vulnerability in Simple Archive Format package import in DSpace

  DSpace · DSpace

  High7.2
• CVE-2022-31192

  Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

  DSpace · DSpace

  High7.1
• CVE-2022-31191

  Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

  DSpace · DSpace

  High7.1