Authenticated SPARQL Injection in 4TU djetuhy allows arbitrary RDF triple writes (CVE-2026-73975)

Vulnerability Overview Title: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples Description: An authenticated contributor can inject arbitrary SPARQL into state modification (DELETE / INSERT) queries by providing a maliciously crafted session name. Because the RDF store is shared, this compromises the integrity of the entire repository's metadata, rather than just the attacker's own records. Prerequisites: An authenticated account is required. allows self-registration via ORCID/SAML, making this a low barrier to entry in typical deployments. Scope Affected Versions: - : = 26.3.2 - : >= 26.3.2 Severity: High (8.4 / 10) CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: Low - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: High - Availability: High - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: High - Availability: None CVE ID: CVE-2026-73975 Weakness: CWE-943 Remediation Root Cause: The name value passes through , but the escaping step (with ) explicitly decodes back to the literal ( ). The double quote is a character required to break SPARQL string literals. The template then uses Jinja2 safe filters (with no escaping) and routes the result to the Virtuoso update endpoint. in the name closes the literal and appends attacker-controlled triple patterns. Remediation Advice: Escape or parameterize SPARQL string literals instead of relying on HTML escaping—e.g., stop binding the reversal of to to SPARQL, or route the field through before templating and apply the filter to the name. Audit other templates that use user-supplied strings. Proof of Concept (POC) The injected triple is stored on the server. (The server has a name limit of 255 characters, which is ample for this workload.)

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated SPARQL Injection in 4TU djetuhy allows arbitrary RDF triple writes (CVE-2026-73975)

More from this source