CVE-2025-53622: DSpace Path Traversal Vulnerability

CVE-2025-53622 Overview

DSpace is an open source repository application that provides durable access to digital resources. CVE-2025-53622 is a path traversal vulnerability [CWE-22] in the Simple Archive Format (SAF) importer. Attackers craft a malicious SAF package whose contents file references arbitrary system paths using relative traversal sequences. When an administrator imports the package through the ./dspace import command or the Batch Import (Zip) interface, DSpace reads files outside the archive that are accessible to the Tomcat user. The result is disclosure of sensitive files and configuration data from the server. The flaw affects DSpace versions prior to 7.6.4, 8.2, and 9.1.

Critical Impact
A malicious SAF archive supplied to a trusted administrator can lead to arbitrary file disclosure from the DSpace server, including configuration files and secrets readable by the Tomcat service account.

Affected Products

DSpace versions prior to 7.6.4
DSpace 8.x versions prior to 8.2
DSpace 9.0 (fixed in 9.1)

Discovery Timeline

2025-07-15 - CVE-2025-53622 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53622

Vulnerability Analysis

The vulnerability resides in the DSpace Simple Archive Format importer. A SAF package is a directory tree containing item metadata and a contents manifest that lists the bitstream files DSpace should ingest. The importer resolves entries in contents relative to the archive directory but does not sanitize traversal sequences such as ../. An attacker can point a contents entry to any absolute or relative path reachable by the Tomcat process. When ingested, DSpace treats the referenced file as a bitstream, copying its contents into the repository where it becomes accessible for retrieval. The importer requires administrator privileges, so exploitation depends on a site administrator (UI or REST API) or system administrator (command line) trusting an externally supplied archive.

Root Cause

The SAF importer fails to validate that paths declared in the contents file resolve within the archive root before opening them for read. Missing canonicalization and containment checks allow relative traversal sequences to escape the archive directory, exposing any file readable by the Tomcat user.

Attack Vector

An attacker prepares a SAF archive whose contents file references sensitive files on the target server, for example configuration files, database credential stores, or private keys owned by the Tomcat account. The attacker delivers the archive to a DSpace administrator through social engineering or an ingestion workflow that accepts third-party content. Once the administrator imports the archive, the traversal payload executes and the referenced files are absorbed as bitstreams and disclosed to any user with read access to the created item. See the GitHub Security Advisory GHSA-vhvx-8xgc-99wf for further technical detail.

Detection Methods for CVE-2025-53622

Indicators of Compromise

SAF contents files containing relative traversal sequences such as ../, ../../, or absolute paths pointing outside the archive directory.
New DSpace items whose bitstreams match server configuration files, private keys, or other files not expected in the repository.
Import job logs referencing file reads from paths outside the SAF archive root.

Detection Strategies

Inspect DSpace import logs for file operations that resolve outside the extracted SAF directory.
Scan submitted archives for contents entries beginning with /, containing .., or otherwise referencing paths outside the archive.
Audit recently created bitstreams for content resembling Tomcat, DSpace, or operating system configuration data.

Monitoring Recommendations

Enable file integrity monitoring on Tomcat and DSpace configuration directories to detect unauthorized read patterns from the Java process.
Alert on administrative invocations of ./dspace import or Batch Import (Zip) REST endpoints and correlate them with the source of the archive.
Log and review REST API calls to the Batch Import endpoints, including uploader identity and archive checksum.

How to Mitigate CVE-2025-53622

Immediate Actions Required

Upgrade DSpace to version 7.6.4, 8.2, or 9.1, whichever matches your deployment branch.
Restrict site administrator privileges and the Batch Import (Zip) capability to a minimal set of trusted operators.
Treat any externally supplied SAF archive as untrusted and inspect contents files before ingestion.

Patch Information

The fix is included in DSpace 7.6.4, 8.2, and 9.1. Sites unable to upgrade can apply the backend patches published in DSpace Pull Request #11036, DSpace Pull Request #11037, and DSpace Pull Request #11038. No frontend changes are required.

Workarounds

Manually inspect every SAF archive not constructed in-house, paying particular attention to entries in the contents file.
Reject archives whose contents file contains .., absolute paths, or symbolic links that leave the archive directory.
Run the DSpace Tomcat process under a dedicated low-privilege account that has no read access to sensitive host configuration files or secrets.

bash

# Configuration example: pre-import validation of a SAF contents file
grep -RnE '(^|/)\.\./|^/' /path/to/saf-archive/*/contents \
  && echo "Rejecting archive: contents file references paths outside the SAF directory" \
  || echo "Contents file passed traversal check"