PT-2025-29566 · Dspace · Dspace

Pablo Picurelli Ortiz + 1 · Published 2025-07-15 · Updated 2025-07-15 · CVE-2025-53621

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 7.6.4 DSpace versions prior to 8.2 DSpace versions prior to 9.1

Description DSpace is a repository application that provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities exist. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format) from the command-line (./dspace import command) or from the "Batch Import (Zip)" user interface feature. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. This may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this issue, the malicious payload would have to be provided by an attacker and trusted by an administrator, who would trigger the import.

Recommendations Upgrade to DSpace version 7.6.4. Upgrade to DSpace version 8.2. Upgrade to DSpace version 9.1. Administrators must carefully inspect any SAF archives they did not construct themselves before importing. As necessary, affected external services can be disabled to mitigate the ability for payloads to be delivered via external service APIs.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-53621

GHSA-JJWR-5CFH-7XWH

Affected Products

Dspace

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53621.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53621 · Security Note
• https://osv.dev/vulnerability/GHSA-jjwr-5cfh-7xwh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53621 · Vendor Advisory
• https://github.com/DSpace/DSpace/pull/11035.patch · Note
• https://github.com/DSpace/DSpace/pull/11032 · Note
• https://github.com/DSpace/DSpace/pull/11032.patch · Note
• https://github.com/DSpace/DSpace/pull/11035 · Note
• https://github.com/DSpace/DSpace/pull/11034 · Note
• https://github.com/DSpace/DSpace/pull/11034.patch · Note
• https://github.com/DSpace/DSpace/security/advisories/GHSA-jjwr-5cfh-7xwh · Note
• https://github.com/DSpace/DSpace · Note
• https://twitter.com/CVEnew/status/1945140328954024116 · Twitter Post
• https://t.me/cvetracker/27864 · Telegram Post