CVE-2025-53622

{"id": "CVE-2025-53622", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 0.9}]}, "published": "2025-07-15T15:15:25.680", "references": [{"url": "https://github.com/DSpace/DSpace/pull/11036", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/11036.patch", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/11037", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/11037.patch", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/11038", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/11038.patch", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-vhvx-8xgc-99wf", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, and 9.1, a path traversal vulnerability is possible during the import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the \"Batch Import (Zip)\" user interface feature. An attacker may craft a malicious Simple Archive Format (SAF) package where the `contents` file references any system files (using relative traversal sequences) which are readable by the Tomcat user. If such a package is imported, this will result in sensitive content disclose, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator (who would trigger the import). The fix is included in DSpace 7.6.4, 8.2 and 9.1. For those who cannot upgrade immediately, it is possible to manually patch the DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.0. Although it is not possible to fully protect the system via workarounds, one may can apply a best practice. Administrators must carefully inspect any SAF archives (they did not construct themselves) before importing, paying close attention to the `contents` file to validate it does not reference files outside of the SAF archives."}, {"lang": "es", "value": "El software de c\u00f3digo abierto DSpace es una aplicaci\u00f3n de repositorio que proporciona acceso duradero a recursos digitales. En versiones anteriores a la 7.6.4, 8.2 y 9.1, exist\u00eda una vulnerabilidad de path traversal durante la importaci\u00f3n de un archivo (en formato de archivo simple), ya sea desde la l\u00ednea de comandos (comando `./dspace import`) o desde la funci\u00f3n de interfaz de usuario \"Importaci\u00f3n por lotes (Zip)\". Un atacante podr\u00eda crear un paquete malicioso en formato de archivo simple (SAF) donde el archivo `contents` haga referencia a cualquier archivo del sistema (mediante secuencias de recorrido relativas) legible para el usuario de Tomcat. Si se importa dicho paquete, se divulgar\u00e1 contenido sensible, incluyendo la recuperaci\u00f3n de archivos o configuraciones arbitrarias del servidor donde se ejecuta DSpace. El importador de formato de archivo simple (SAF)/Importaci\u00f3n por lotes (Zip) solo puede ser utilizado por administradores del sitio (desde la interfaz de usuario/API REST) o administradores del sistema (desde la l\u00ednea de comandos). Por lo tanto, para explotar esta vulnerabilidad, el payload malicioso tendr\u00eda que ser proporcionado por un atacante y contar con la confianza de un administrador (quien activar\u00eda la importaci\u00f3n). La soluci\u00f3n est\u00e1 incluida en DSpace 7.6.4, 8.2 y 9.1. Quienes no puedan actualizar inmediatamente, pueden aplicar un parche manualmente al backend de DSpace (no es necesario modificar el frontend). Existe una solicitud de extracci\u00f3n que puede utilizarse para aplicar parches a sistemas que ejecutan DSpace 7.6.x, 8.x o 9.0. Aunque no es posible proteger completamente el sistema mediante soluciones alternativas, se puede aplicar una pr\u00e1ctica recomendada. Los administradores deben inspeccionar cuidadosamente cualquier archivo SAF (que no hayan creado ellos mismos) antes de importar, prestando especial atenci\u00f3n al archivo `contents` para verificar que no haga referencia a archivos externos a los archivos SAF."}], "lastModified": "2025-07-15T20:07:28.023", "sourceIdentifier": "security-advisories@github.com"}