DSpace vulnerabilities
We track 3 vulnerabilities in DSpace products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 2, 2026.
Latest DSpace vulnerabilities
- 8.0 High severity
DSpace: Improper Control of Generation of Code
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates
- 7.2 High severity
DSpace: Improper Limitation of a Pathname to a Restricted Directory
DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) packa
- 7.2 High severity
DSpace: Improper Limitation of a Pathname to a Restricted Directory
DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to mu