CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
Authenticated attackers can inject SPARQL via session names to modify or delete arbitrary RDF triples, compromising repository-wide metadata integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73975?
CVE-2026-73975 is a high-severity code injection vulnerability in 4TUResearchData djehuty, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.
Weakness: CWE-943
Which versions are affected by CVE-2026-73975?
How do I fix CVE-2026-73975?
No fix has been published for CVE-2026-73975 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73975 exists.
Sources
Also known as GHSA-9864-23x8-762h.