Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

For information regarding which versions of DSpace are currently under support, please see our DSpace Software Support Policy:

https://wiki.lyrasis.org/display/DSPACE/DSpace+Software+Support+Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in a supported version of DSpace, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly fix the problem. Please see our DSpace Software Support Policy for information on privately reporting vulnerabilities:

https://wiki.lyrasis.org/display/DSPACE/DSpace+Software+Support+Policy

Path traversal vulnerability in Simple Archive Format (SAF) package import via "contents" file
GHSA-vhvx-8xgc-99wf published Jul 15, 2025 by tdonohue

Moderate
XML External Entity (XXE) injection possible in import via Simple Archive Format (SAF) or import from external sources
GHSA-jjwr-5cfh-7xwh published Jul 15, 2025 by tdonohue

Moderate
Cross Site Scripting (XSS) possible via a deposited HTML/XML document with embedded JavaScript
GHSA-94cc-xjxr-pwvf published Jun 25, 2024 by tdonohue

Low
Communities and collections administrators can escalate their privilege up to system administrator
GHSA-cf2j-vf36-c6w8 published Oct 29, 2021 by tdonohue

High
Path traversal vulnerability in Simple Archive Format package import (ItemImportService API)
GHSA-8rmh-55h4-93h5 published Jul 29, 2022 by tdonohue

High
Path traversal vulnerabilities in JSPUI submission (resumable) upload
GHSA-qp5m-c3m9-8q2p published Jul 29, 2022 by tdonohue

High
"Internal System Error" page in JSPUI prints exceptions and stack traces without sanitization
GHSA-c2j7-66m3-r4ff published Jul 29, 2022 by tdonohue

Low
Cross Site Scripting (XSS) possible in JSPUI "Request a Copy" feature
GHSA-4wm8-c2vv-xrpq published Jul 29, 2022 by tdonohue

Moderate
URL Redirection to Untrusted Site ('Open Redirect') in JSPUI's controlled vocabulary feature
GHSA-763j-q7wv-vf3m published Jul 29, 2022 by tdonohue

High
Cross Site Scripting (XSS) possible in JSPUI spellcheck and autocomplete tools
GHSA-c558-5gfm-p2r8 published Jul 29, 2022 by tdonohue

Moderate

Previous 1 2 Next

Learn more about advisories related to DSpace/DSpace in the GitHub Advisory Database