CVE-2025-53622: DSpace Path Traversal Vulnerability in Simple Archive Format Import
Summary
CVE-2025-53622: DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format. Affects org.dspace:dspace-api across 3 version ranges.
< 7.6.4
>= 8.0, < 8.2
>= 9.0, < 9.1
Fixed in 7.6.4, 8.2 or 9.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DSpace is a widely-used open-source repository software that enables institutions to manage and share digital content. It provides functionalities for archiving, preserving, and disseminating scholarly works. The software is designed for flexibility and scalability, making it suitable for various academic and research environments. However, a recent vulnerability has been identified that exposes DSpace to path traversal attacks during the import of Simple Archive Format (SAF) packages, potentially leading to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from improper validation of file paths in the SAF package during the import process. An attacker can craft a malicious SAF package that references system files using relative traversal sequences. If an administrator imports such a package, it could lead to sensitive content disclosure, allowing the attacker to retrieve arbitrary files or configurations from the server where DSpace is running. This vulnerability affects all versions of DSpace 1.x up to 7.6.3, 8.0 up to 8.1, and 9.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.6.47.6.4 -
>= 8.0, < 8.28.2 -
>= 9.0, < 9.19.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, manually inspect any SAF archives before importing. Ensure that the 'contents' file does not reference files outside of the SAF package. Avoid importing large SAF archives until the system is patched.
Conclusion
The path traversal vulnerability in DSpace during the import of SAF packages poses a significant risk of sensitive data exposure. It is crucial for administrators to upgrade to the patched versions or implement workarounds to mitigate the risk. Regular monitoring using tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for org.dspace:dspace-api →
FAQ
The vulnerability is a path traversal issue that allows attackers to access sensitive files on the server by importing malicious SAF packages.
All versions of DSpace 1.x up to 7.6.3, 8.0 up to 8.1, and 9.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you cannot upgrade, manually inspect SAF archives before importing and avoid importing large archives until the system is patched.
The CVSS score of this vulnerability is 5.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.dspace:dspace-api.
