Skip to content
Heist/ feed
Back to feed
Medium

DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

Type: advisorySources: OSV

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interface feature. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. In the latter case, this may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator, who would trigger the import. The fix is included in DSpace 7.6.4, 8.2, and 9.1. Please upgrade to one of these versions. For those who can

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-53621
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 16:32 UTC · Revision 1

Source evidence

DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

core-osv · Original source

Published 15 Jul 2025, 14:44 UTC

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interface feature. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. In the latter case, this may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator, who would trigger the import. The fix is included in DSpace 7.6.4, 8.2, and 9.1. Please upgrade to one of these versions. For those who can

osv:CVE-2025-53621
Complete source record
{
  "id": "f1cc073de3a935d63b040f610648861bc7d31a7b6b2279c4af6034a8a4926ea1",
  "url": "https://osv.dev/vulnerability/CVE-2025-53621",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources",
    "summary": "DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the \"Batch Import (Zip)\" user interface feature. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. In the latter case, this may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator, who would trigger the import. The fix is included in DSpace 7.6.4, 8.2, and 9.1. Please upgrade to one of these versions. For those who can",
    "evidence": "osv:CVE-2025-53621",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-53621",
      "aliases": [
        "CVE-2025-53621",
        "GHSA-jjwr-5cfh-7xwh"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/dspace/dspace",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a5f04f9c7731dbf088a00e28012367f24d76842b"
                },
                {
                  "introduced": "b2ae1d54190f10d2e92ab54ad361e283199f444b"
                },
                {
                  "fixed": "1743314da4f38f0539c03e71c798f53ca158bf1a"
                },
                {
                  "introduced": "c67e99925344335382be05015d604f85edcdfdde"
                },
                {
                  "fixed": "1af2454045e41d0e8c414c4e9b9e61cba73593fe"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.6.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "8.0"
                      },
                      {
                        "fixed": "8.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "9.0"
                      },
                      {
                        "fixed": "9.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  }
                ]
              }
            }
          ],
          "versions": [
            "dspace-7.6",
            "dspace-9.0",
            "dspace-7.6.3",
            "dspace-8.1",
            "dspace-7.4",
            "dspace-7.6.2",
            "dspace-8.0",
            "dspace-7.6.1",
            "dspace-7.2",
            "dspace-7.0",
            "dspace-7.5",
            "dspace-7.3",
            "dspace-7.1",
            "dspace-7.0-beta5",
            "dspace-7.0-beta4.1",
            "dspace-7.0-beta4",
            "dspace-7.0-beta3",
            "dspace-7.0-beta2.1",
            "dspace-7.0-beta2",
            "dspace-7.0-beta1",
            "dspace-7.0-preview-1",
            "dspace-6.0",
            "dspace-6.0-rc4",
            "dspace-6.0-rc3",
            "dspace-6.0-rc2",
            "dspace-6.0-rc1",
            "dspace-6.0-pre-DS-2701",
            "dspace-5.0",
            "dspace-5.0-rc3",
            "dspace-5.0-rc2",
            "dspace-5.0-rc1",
            "dspace-4.0",
            "dspace-4.0-rc3",
            "dspace-4.0-rc2",
            "dspace-4.0-rc1",
            "dspace-3.0",
            "dspace-3.0-rc3",
            "dspace-3.0-rc2",
            "dspace-3.0-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53621.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.655698836Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53621.json",
        "https://github.com/DSpace/DSpace/security/advisories/GHSA-jjwr-5cfh-7xwh",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-53621",
        "https://github.com/DSpace/DSpace/pull/11032",
        "https://github.com/DSpace/DSpace/pull/11032.patch",
        "https://github.com/DSpace/DSpace/pull/11034",
        "https://github.com/DSpace/DSpace/pull/11034.patch",
        "https://github.com/DSpace/DSpace/pull/11035",
        "https://github.com/DSpace/DSpace/pull/11035.patch"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-611"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53621.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-53621",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504726,
  "published_at": "2025-07-15T14:44:01.435+00:00"
}