CVE-2016-10726 High severity vulnerability that affects org.dspace:dspace-xmlui

What is CVE-2016-10726?

CVE-2016-10726 is a high-severity path traversal vulnerability in n/a, published on 10 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Weakness: CWE-22

Which versions are affected by CVE-2016-10726?

6 open source packages ship an affected version, including org.dspace:dspace-xmlui. It affects 1 product.

Products include Duraspace Dspace.

How do I fix CVE-2016-10726?

Upgrade org.dspace:dspace-xmlui to a fixed version for your release line: 3.6, 4.5 or 5.5.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-10726 being exploited?

There is no known exploitation of CVE-2016-10726 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload High 8.2
• CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace High 7.2
• CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator High 7.2
• CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools High 7.1
• CVE-2022-31192 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4m9r-5gqp-7j82.