Description

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-02T18:19:32.980Z",
  "pubdate": "2026-09-02T18:19:32.980Z",
  "executiveSummary": "DSpace contains a path traversal vulnerability within its COAR Notify / LDN (Linked Data Notifications) service, identified in versions 8.0-rc1 through 8.4, 9.0-rc1 through 9.3, and 10-rc1 through 10.0.\nThe vulnerability allows an authenticated administrator to read arbitrary files from the server's file system by manipulating the inbound pattern or template input stream used during LDN message generation.\nBy bypassing path validation, an attacker can force the system to interpret unauthorized files as Apache Velocity templates, leading to sensitive data exposure or potentially facilitating further exploitation based on the content of the traversed files.\nSuccessful exploitation requires the attacker to possess DSpace administrator credentials, serving as a significant privilege escalation or post-compromise mechanism.\nThe risk is mitigated by upgrading to patched versions 8.4, 9.3, or 10.0, which introduce necessary path checks and restrict template access to authorized directories.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the LDN (Linked Data Notification) service, specifically within the logic responsible for processing 'inbound pattern' or 'template' input streams used in LDN message generation.\nThe vulnerable component fails to implement robust directory traversal checks or strictly enforce a base path restriction when accessing file input streams. Consequently, the application does not validate that the requested template file resides within the expected repository directory.\nExploitation requires an attacker to possess valid DSpace administrator credentials. The attack flow involves submitting a crafted request to the LDN service that points to a target file outside the intended template directory. Because the application processes this path without sanitization, it treats the targeted file—such as an export log, a bitstream path, or a temporary file—as an Apache Velocity template.\nOnce the attacker successfully points the application to an arbitrary file, the Apache Velocity template engine parses the content of that file as part of the LDN message generation process. This mechanism can be leveraged to expose the contents of system files or configuration data that the application is capable of reading.\nThe impact of this vulnerability is significant as it grants an administrator the ability to read sensitive information residing on the server's file system that would otherwise be inaccessible via standard interface components. By interpreting these files as templates, the attacker effectively circumvents file-system boundaries imposed by the application’s intended design.\nAffected versions include 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0. The vulnerability is strictly an application-layer flaw occurring during file retrieval and template compilation, requiring administrative access to the DSpace platform to initiate the malicious request."
}