Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

GHSA-vhvx-8xgc-99wf

MEDIUM

DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format

Also known asCVE-2025-53622
Published
Jul 15, 2025
Updated
Jul 15, 2025
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk32th percentile+0.14%
0.00%0.30%0.60%0.90%0.1%0.4%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

3 pkgs affected
☕org.dspace:dspace-api☕org.dspace:dspace-api☕org.dspace:dspace-api

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A path traversal vulnerability is possible during the import of an archive (in Simple Archive Format), either from command-line (./dspace import command) or from the "Batch Import (Zip)" user interface feature. This vulnerability likely impacts all versions of DSpace 1.x <= 7.6.3, 8.0 <= 8.1, and 9.0.

An attacker may craft a malicious Simple Archive Format (SAF) package where the contents file references any system files (using relative traversal sequences) which are readable by the Tomcat user. If such a package is imported, this will result in sensitive content disclose, including retrieving arbitrary files or configurations from the server where DSpace is running.

The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator (who would trigger the import).

  • The most severe practical impact is a case where an attacker obtains DSpace administrator credentials and uses the Batch Import feature with a malicious SAF archive to expose sensitive local files readable by the Tomcat user.
  • An attacker without administrative credentials might use some other tactic to convince an administrator to import a malicious SAF archive they have supplied.

Patches

The fix is included in DSpace 7.6.4, 8.2 and 9.1. Please upgrade to one of these versions.

If you cannot upgrade immediately, it is possible to manually patch your DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.0. This pull request provides validation checks of paths in the contents file of an SAF package to ensure it does not reference any files outside of the SAF package.

Apply the patch to your DSpace

If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches to your DSpace backend as follows:

  1. Download the appropriate patch file to the machine where DSpace backend is running
  2. From the [dspace-src] folder, apply the patch, e.g. git apply [name-of-file].patch
  3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. mvn -U clean package (This will recompile all DSpace backend code)
    2. Redeploy DSpace, e.g. ant update (This will copy all newly built code to your installation directory). Depending on your setup you also may need to copy the updated "server" webapp over to your Tomcat webapps folder.
    3. Restart Tomcat (or runnable JAR)

Workarounds

Patching the system is the recommended fix. It is not possible to fully protect your system via workarounds.

That said, until you are able to patch your system or upgrade, you can apply these best practices:

  • Administrators must carefully inspect any SAF archives (they did not construct themselves) before importing, paying close attention to the contents file to validate it does not reference files outside of the SAF archives.
  • If SAF archives are too large to manually inspect, you should avoid importing them until your site is patched.

Credits

Discovered & reported by Marcin Miłosz (@MMilosz) of PCG Academia Code fix developed by Marcin Miłosz of PCG Academia and Kim Shepherd (@kshepherd) of The Library Code

For more information

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.dspace:dspace-apiall versions7.6.4
☕Mavenorg.dspace:dspace-api≥ 8.0&&< 8.28.2
☕Mavenorg.dspace:dspace-api≥ 9.0&&< 9.19.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.dspace:dspace-api. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update org.dspace:dspace-api to 7.6.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vhvx-8xgc-99wf is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-vhvx-8xgc-99wf is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-vhvx-8xgc-99wf. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact A path traversal vulnerability is possible during the import of an archive (in [Simple Archive Format](https://wiki.lyrasis.org/pages/viewpage.action?pageId=104566653)), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interface feature. _This vulnerability likely impacts all versions of DSpace 1.x <= 7.6.3, 8.0 <= 8.1, and 9.0_. An attacker may craft a malicious Simple Archive Format (SAF) package where the `contents` file references any system files (using relative traversal sequences) which are readable by the Tomcat user. If such a p
O3 Security · Impact-Aware SCA

Is GHSA-vhvx-8xgc-99wf in your dependencies?

O3 detects GHSA-vhvx-8xgc-99wf across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works