What’s Vulnerable › Products

DSpace vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your DSpace version is affected

Latest DSpace vulnerabilities

• CVE-2026-49833 — DSpace: Path Traversal possible in LDN message generation (CVSS 5.5)
• CVE-2026-49832 — DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN (CVSS 8.0)
• CVE-2026-49831 — DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) (CVSS 5.5)
• CVE-2026-49830 — DSpace: ORE resource URI does not validate scheme for non-web resources (CVSS 4.4)
• CVE-2025-53622 — DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file (CVSS 5.2)
• CVE-2025-53621 — DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources (CVSS 6.9)
• CVE-2024-38364 — DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document (CVSS 2.6)
• CVE-2022-31195 — Path traversal vulnerability in Simple Archive Format package import in DSpace (CVSS 7.2)
• CVE-2022-31194 — Path traversal vulnerabilities in DSpace JSPUI submission upload (CVSS 7.2)
• CVE-2022-31193 — URL Redirection to Untrusted Site in Dspace JSPUI (CVSS 6.1)
• CVE-2022-31192 — Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature (CVSS 6.1)
• CVE-2022-31191 — Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools (CVSS 6.1)
• CVE-2022-31189 — "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization (CVSS 5.3)
• CVE-2022-31190 — Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI (CVSS 5.3)
• CVE-2021-41189 — Communities and collections administrators can escalate their privilege up to system administrator (CVSS 7.2)
• CVE-2016-10726 — (CVSS 7.5)