Description

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-02T18:19:32.027Z",
  "pubdate": "2026-09-02T18:19:32.027Z",
  "executiveSummary": "DSpace is susceptible to a Local File Inclusion (LFI) vulnerability residing within the ORE Ingestion Crosswalk component. The issue stems from insufficient validation of URI schemes during the ingestion of aggregated ORE resources. This security flaw allows an authenticated attacker with collection administrator privileges to read sensitive files from the underlying host filesystem by leveraging the file:/// protocol scheme. The vulnerability impacts DSpace versions prior to 7.6.7, 8.4, 9.3, and 10.0. Successful exploitation results in unauthorized access to restricted local files, potentially exposing configuration details, system credentials, or sensitive data stored on the server. Although the requirement for collection administrator privileges limits the attack surface, the risk remains significant due to the potential for full information disclosure and subsequent privilege escalation or lateral movement within the hosting environment.",
  "technicalDetails": "The vulnerability exists within the OAI-ORE Harvester implementation in DSpace. When the system processes an aggregated ORE resource, it utilizes the ORE Ingestion Crosswalk to parse and fetch URI-referenced resources. The core defect is an input validation failure: the application fails to restrict or sanitize the URI scheme before passing the input to the underlying resource fetcher.\nBecause the crosswalk does not enforce an allowlist of permitted protocols (such as http or https), it implicitly trusts user-supplied URIs. An attacker with administrative privileges for a DSpace collection can manipulate the ingestion process by providing a malicious URI utilizing the file:/// protocol scheme. For example, by specifying 'file:///etc/passwd' as the URI for an ORE resource, the harvester is coerced into treating the local file system as a remote resource repository.\nThe attack flow follows these steps: 1) The authenticated attacker accesses the collection administration interface. 2) The attacker initiates an ORE ingestion task. 3) The attacker injects a crafted URI containing a malicious scheme (e.g., file:///etc/passwd) into the harvester configuration. 4) The ORE Ingestion Crosswalk attempts to resolve the provided URI. 5) Due to the lack of validation, the application successfully opens the local file system path and reads the target file content. 6) The contents of the local file are then processed and stored within the repository metadata or exposed through the application interface.\nThis vulnerability is classified as Local File Inclusion (LFI). The impact is highly critical, as it bypasses standard access controls for the filesystem. A malicious actor could read system files, environment variables, or application configuration files containing database credentials, API keys, or administrative tokens. This allows for deeper reconnaissance of the host system. The issue affects all DSpace deployments using versions prior to the 7.6.7, 8.4, 9.3, and 10.0 releases. Remediation requires an immediate upgrade to these versions, which implement rigorous URI scheme filtering to ensure only expected network protocols are utilized by the Harvester component."
}