{"cve":"CVE-2026-49831","nvd":{"published":"2026-09-02T18:19:32.683","modified":"2026-09-09T21:05:23.237","status":"Awaiting Analysis","description":"DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","score":5.5},"cwes":["CWE-22"],"references":["https://github.com/DSpace/DSpace/pull/12539","https://github.com/DSpace/DSpace/pull/12540","https://github.com/DSpace/DSpace/pull/12552","https://github.com/DSpace/DSpace/security/advisories/GHSA-v66x-68f2-pxf5"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:50.842544443+00:00"},"epss":{"cve":"CVE-2026-49831","score":0.00527,"percentile":0.44631,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v66x-68f2-pxf5","url":"https://osv.dev/vulnerability/GHSA-v66x-68f2-pxf5","summary":"DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path","modified":"2026-07-08T20:41:41.496120Z","packages":[{"ecosystem":"Maven","name":"org.dspace:dspace-api","purl":"pkg:maven/org.dspace/dspace-api","ranges":["<7.6.7"],"fixed":["7.6.7"]},{"ecosystem":"Maven","name":"org.dspace:dspace-api","purl":"pkg:maven/org.dspace/dspace-api","ranges":[">=8.0-rc1 <8.4"],"fixed":["8.4"]},{"ecosystem":"Maven","name":"org.dspace:dspace-api","purl":"pkg:maven/org.dspace/dspace-api","ranges":[">=9.0-rc1 <9.3"],"fixed":["9.3"]},{"ecosystem":"Maven","name":"org.dspace:dspace-api","purl":"pkg:maven/org.dspace/dspace-api","ranges":[">=10-rc1 <10.0"],"fixed":["10.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}