https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-31195.htmlhttps://patchthecve.com/cve/CVE-2022-31195.htmlWed, 17 Jun 2026 04:45:00 +0000HIGH 7.2: DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a file/directory to be crhttps://patchthecve.com/cve/CVE-2022-31194.htmlhttps://patchthecve.com/cve/CVE-2022-31194.htmlWed, 17 Jun 2026 04:45:00 +0000HIGH 8.2: DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing https://patchthecve.com/cve/CVE-2022-31193.htmlhttps://patchthecve.com/cve/CVE-2022-31193.htmlWed, 17 Jun 2026 04:45:00 +0000HIGH 7.1: DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legithttps://patchthecve.com/cve/CVE-2022-31192.htmlhttps://patchthecve.com/cve/CVE-2022-31192.htmlWed, 17 Jun 2026 04:45:00 +0000HIGH 7.1: DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item requestshttps://patchthecve.com/cve/CVE-2022-31191.htmlhttps://patchthecve.com/cve/CVE-2022-31191.htmlWed, 17 Jun 2026 04:44:59 +0000HIGH 7.1: DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocohttps://patchthecve.com/cve/CVE-2022-31189.htmlhttps://patchthecve.com/cve/CVE-2022-31189.htmlWed, 17 Jun 2026 04:44:59 +0000MEDIUM 5.3: DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may bhttps://patchthecve.com/cve/CVE-2022-31190.htmlhttps://patchthecve.com/cve/CVE-2022-31190.htmlWed, 17 Jun 2026 04:44:59 +0000MEDIUM 5.3: DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Itehttps://patchthecve.com/cve/CVE-2021-41189.htmlhttps://patchthecve.com/cve/CVE-2021-41189.htmlWed, 17 Jun 2026 04:08:03 +0000HIGH 7.2: DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a worka