CVE-2026-49831 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-49831

CVSS 5.5 · Medium EPSS 0,53%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

Rincian

Terbit di NVD: 2 September 2026
Terakhir diubah: 9 September 2026
Status NVD: Awaiting Analysis
CVSS 3.1: 5.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,53% peluang dieksploitasi; lebih tinggi dari 43,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.