Description

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-02T18:19:32.683Z",
  "pubdate": "2026-09-02T18:19:32.683Z",
  "executiveSummary": "DSpace, an open-source repository software, is susceptible to a critical Path Traversal vulnerability within its curation task functionality. This security flaw allows an authenticated attacker to manipulate the file system by leveraging the '-r' (reporter) parameter within the curate script.\nBy bypassing intended directory restrictions, an attacker can coerce the application to write files to arbitrary locations on the server, provided the system user running the DSpace process (typically 'tomcat') has the necessary write permissions. This vulnerability poses a significant risk, as it facilitates unauthorized file creation or overwriting of system-critical files, which may lead to remote code execution (RCE) or denial-of-service (DoS) conditions.\nThe flaw affects versions prior to 7.6.7, 8.4, 9.3, and 10.0. Successful exploitation generally requires access to the command-line interface or the administrative execution context where curation tasks are initiated. Organizations are urged to upgrade to the specified patched versions to remediate this vector.",
  "technicalDetails": "The vulnerability resides in the curation task execution logic of the DSpace curate script, specifically in how the application handles the reporter output path parameter ('-r'). The underlying root cause is the lack of proper input validation and path sanitization when defining the destination for curation task logs and status results.\nUnder normal operating conditions, the curation task reporter is intended to write output logs to a predefined, secure directory. However, the implementation fails to enforce a base path restriction, effectively allowing directory traversal sequences (e.g., '../') to be passed via the '-r' parameter. Because the script executes with the privileges of the service user, the application will write or overwrite files anywhere the 'tomcat' user has write access.\nThe attack flow begins with an attacker identifying a curation task entry point. By supplying a crafted '-r' argument containing relative path traversal sequences, the attacker directs the output stream of the task to a sensitive directory. For instance, an attacker might target web root directories to deploy malicious scripts or configuration directories to overwrite system settings. Since the curation task processes digital resource information, the content of the injected file can be partially influenced by the attacker if they can control the input data being processed by the curation task.\nThe impact of this vulnerability is high, as it enables arbitrary file write capabilities. By overwriting configuration files (e.g., dspace.cfg, web.xml) or binary components, an attacker could achieve persistence, modify application behavior, or trigger remote code execution within the context of the DSpace repository instance. Furthermore, if the attacker can overwrite executable scripts within the PATH or crontab files, system-level compromise becomes a potential outcome.\nThis vulnerability is present in versions prior to 7.6.7, 8.4, 9.3, and 10.0. While it primarily requires access to the system executing the curate script, this is often reachable by administrative users or in environments where the command-line interface is exposed to automated systems. The lack of strict path validation means the application blindly trusts user-provided directory strings, violating basic secure coding principles regarding input sanitization in file I/O operations."
}