Path Traversal Vulnerability in DSpace Open Source Repository Software

CVE-2025-53622

What is CVE-2025-53622?

DSpace is an open source digital repository application that allows for durable access to digital resources. Versions prior to 7.6.4, 8.2, and 9.1 are vulnerable to a path traversal exploit during archive imports. An attacker could create a malicious Simple Archive Format (SAF) package, which might reference system files by using relative paths, allowing unauthorized access to sensitive content or configurations on the server. To mitigate this risk, it's crucial that administrators examine any SAF archives imported from external sources, ensuring that the 'contents' file does not point to files outside of the intended archive. Immediate upgrading is recommended, but those unable to upgrade can apply a manual patch as a temporary measure.

References