DSpace CVE-2025-48831: Path Traversal in Curation Task Reporter Output

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Path Traversal Vulnerability in the Output Path of the Curation Task Reporter CVE ID: CVE-2025-48831 Severity: Moderate Description: The feature allows an output path to be specified via the reporter's parameter. Since this path is not restricted, an attacker holding DSpace/CommunitySite administrator credentials can exploit it to set the parameter to redirect the output to an arbitrary location (such as the Spring Boot directory or to overwrite configuration files), which may lead to denial of service or privilege escalation. Scope of Impact Affected Versions: ≤ 7.6.6, 8.0 – 8.3.0, 9.0 – 9.2 Fixed Versions: 7.6.7, 8.4.3, 9.1.0 Affected Component: (Maven) CVSS v3.1 Score: 5.5 / 10 (Network Vector, Low Complexity, High Privilege Requirement, No User Interaction, Unchanged Scope, Confidentiality/Integrity/Availability Impact: None/Low/High) Remediation 1. Upgrade: Upgrade to version 7.6.7, 8.4.3, or 9.1.0. 2. Patch (if immediate upgrade is not possible): - 8.x Patch: PR #12525 (also fixes a similar path traversal vulnerability in LDM messages) - 8.x Patch: PR #12540 (also fixes the path traversal vulnerability in LDM messages) - 7.x Patch: PR #12539 3. Temporary Mitigation: Comment out all plugins in . For example: > Note: After commenting out all CuratorTask entries, ensure that curation tasks are not accidentally triggered from the user interface or the command line. Additionally, avoid automatically running specific curation tasks via the command from scheduled cron jobs or planned tasks. Contributors Discovery & Reporting: Paolo Piccinelli Ortiz (@supergeorge2013), a cybersecurity student at the University of Rey Juan Carlos Code Fix: Kim Shepherd (@kshepherd), Library Code

Goal Reached Thanks to every supporter — we hit 100%!

DSpace CVE-2025-48831: Path Traversal in Curation Task Reporter Output

More from this source