CVE-2025-53622 – DSpace has a path traversal vulnerability in it... (How to Fix)

Q: What is the severity of CVE-2025-53622?

CVE-2025-53622 has a CVSS score of 5.2 (MEDIUM). DSpace has a path traversal vulnerability in its Simple Archive Format (SAF) import functionality that allows attackers to read arbitrary files on the server when administrators import malicious archives. Only administrators can trigger this vulnerability by importing untrusted SAF packages. This affects DSpace versions prior to 7.6.4, 8.2, and 9.1.

📋 TL;DR

DSpace has a path traversal vulnerability in its Simple Archive Format (SAF) import functionality that allows attackers to read arbitrary files on the server when administrators import malicious archives. Only administrators can trigger this vulnerability by importing untrusted SAF packages. This affects DSpace versions prior to 7.6.4, 8.2, and 9.1.

💻 Affected Systems

Products:

DSpace

Versions: All versions prior to 7.6.4, 8.2, and 9.1

Operating Systems: All operating systems running DSpace

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in both command-line import (./dspace import) and web interface Batch Import (Zip) features.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise through disclosure of sensitive configuration files, credentials, or system files leading to further attacks.

🟠

Likely Case

Disclosure of sensitive DSpace configuration files, database credentials, or other application data stored on the server.

🟢

If Mitigated

No impact if administrators only import trusted, self-created archives or have patched the system.

🌐 Internet-Facing: MEDIUM - While exploitation requires admin access, internet-facing DSpace instances with admin interfaces exposed increase attack surface.

🏢 Internal Only: MEDIUM - Internal administrators could be tricked into importing malicious archives via social engineering or compromised sources.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple path traversal in contents file, but requires admin to import malicious archive.

Exploitation requires social engineering or compromise of archive sources to trick administrators into importing malicious SAF packages.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: DSpace 7.6.4, 8.2, and 9.1

Vendor Advisory: https://github.com/DSpace/DSpace/pull/11036

Restart Required: Yes

Instructions:

1. Upgrade to DSpace 7.6.4, 8.2, or 9.1. 2. Apply patches from GitHub pull requests #11036, #11037, #11038 for manual patching. 3. Restart Tomcat/application server.

🔧 Temporary Workarounds

Disable SAF Import

all

Temporarily disable Simple Archive Format import functionality until patching is possible.

Remove or restrict access to import commands and web interface features

🧯 If You Can't Patch

Implement strict policy requiring administrators to only import self-created SAF archives
Manually inspect all contents files in SAF archives for path traversal sequences before import

🔍 How to Verify

Check if Vulnerable:

Check DSpace version: if running version older than 7.6.4, 8.2, or 9.1, system is vulnerable.

Check Version:

Check DSpace version in web interface or run: ./dspace version

Verify Fix Applied:

After patching, test SAF import with a test archive containing path traversal sequences to confirm they are blocked.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns during SAF imports
Errors related to file not found outside archive directory

Network Indicators:

Large data transfers during SAF import operations

SIEM Query:

Search for import operations accessing files outside expected archive directories

📊 Metadata

CVE ID: CVE-2025-53622

CVSS v3 Score: 5.2 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:L

CWE: CWE-22

EPSS Score: 0.05% exploit probability (13.6th percentile)

Published: July 15, 2025

Last Updated: July 15, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-53622, you might also want to check these: