CVE-2026-49831: 
Java vulnerability analysis and mitigation

CVE-2026-49831 is a Path Traversal vulnerability (CWE-22) in the DSpace Curation Task feature's reporter output path (-r parameter), which fails to restrict the base directory for file output. This allows authenticated Collection/Community/Site Administrators to write curation task output to arbitrary locations writable by the DSpace (typically 'tomcat') user, such as configuration directories or web-accessible static resource folders. Affected versions include DSpace ≤ 7.6.6, 8.0–8.3, 9.0–9.2, and 10-rc1. The vulnerability was discovered by Pablo Picurelli Ortiz and first published on June 1, 2026, with the GitHub Advisory Database entry updated July 8, 2026. It carries a CVSS v3.1 base score of 5.5 (Moderate) (GitHub Advisory, DSpace Advisory).

The root cause is improper path validation (CWE-22) in the curate script's reporter (-r) parameter, which accepts arbitrary filesystem paths without restricting output to a configured safe base directory. The vulnerability became exploitable via the web UI when DSpace extended curation task execution privileges to Collection/Community/Site Administrators — previously, only command-line system administrators could invoke curation tasks. An attacker with valid DSpace admin credentials can craft a curation task invocation through the web interface, supplying a path-traversal sequence (e.g., ../../dspace/config/) as the reporter output path, causing task output to be written to sensitive locations such as /dspace/config/, /dspace/bin/, or the Spring Boot webapp's static resources folder. The fix restricts the reporter output to a configured allowlist of directories and removes the -r parameter from web-managed curation task processes entirely (GitHub Advisory, DSpace Advisory).

Successful exploitation can result in overwriting critical configuration files (e.g., in /dspace/config/ or /dspace/bin/), leading to denial of service or system misconfiguration. An attacker could also write attacker-controlled content into web-accessible static resource directories, potentially enabling further attacks such as serving malicious payloads to users. There is no direct confidentiality impact (no file read capability), but integrity and availability are both affected; privilege escalation is theoretically possible if output containing executable content is combined with other attack vectors or custom curation tasks (GitHub Advisory, DSpace Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory date. Exploitation requires authenticated access with at least DSpace Collection/Community/Site Administrator credentials, significantly limiting the attacker pool. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently associated with this vulnerability (GitHub Advisory, DSpace Advisory).

1. Obtain credentials: Acquire valid DSpace Collection, Community, or Site Administrator credentials through phishing, credential stuffing, or insider access.
2. Access the Curation Task UI: Log into the DSpace web interface and navigate to the administrative Curation Task panel (available to Collection/Community/Site Administrators).
3. Craft a malicious reporter path: When configuring a curation task, supply a path-traversal string as the reporter (-r) output parameter, e.g., ../../dspace/config/dspace.cfg or a path pointing to the Spring Boot webapp's static resources directory.
4. Execute the curation task: Trigger the curation task via the web UI. The task output (which may include attacker-influenced content depending on the task) is written to the traversed path.
5. Achieve objective: Depending on the target path, the attacker may overwrite a configuration file (causing denial of service or misconfiguration), or place content in a web-accessible directory for use in follow-on attacks (GitHub Advisory, DSpace Advisory).

• Logs: DSpace or Tomcat application logs showing curation task invocations with reporter (-r) parameters containing path traversal sequences (e.g., ../, %2e%2e%2f) or paths outside expected output directories.
• File System: Unexpected new or modified files in /dspace/config/, /dspace/bin/, or the Spring Boot webapp's static resources folder with timestamps correlating to curation task execution times; file ownership matching the Tomcat/DSpace service account.
• Application Logs: Audit log entries in DSpace showing curation task runs initiated by administrator accounts at unusual times or with unusual frequency.
• Network: Web requests to DSpace admin curation task endpoints (e.g., /api/system/curations) from unexpected IP addresses or at unusual hours (GitHub Advisory).

Upgrade to DSpace 7.6.7, 8.4, 9.3, or 10.0, which contain the fix restricting reporter output to configured safe directories and removing the -r parameter from web-managed curation processes. Manual patches are available for 7.x (PR #12539), 8.x (PR #12540), and 9.x (PR #12552) and can be applied via git apply [patch-file].patch followed by rebuilding (mvn -U clean package), redeploying (ant update), and restarting Tomcat. As an immediate workaround if patching is not possible, disable all Curation Tasks by commenting out every plugin.named.org.dspace.curate.CurationTask line in curate.cfg, noting this will also disable any scheduled curation task cron jobs (DSpace Advisory, GitHub Advisory).

The vulnerability was discovered and reported by Pablo Picurelli Ortiz (@superpegaso2703), a cybersecurity student at Universidad Rey Juan Carlos, and the code fix was developed by Kim Shepherd (@kshepherd) of The Library Code. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (DSpace Advisory).