MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE) by milanmajchrak · Pull Request #1336 · dataquest-dev/DSpace

milanmajchrak · 2026-06-11T09:29:23Z

Security patches from vanilla DSpace 9.3

This branch is based on DSpace 9.1, which is affected by all four security advisories fixed in DSpace 9.3 (2026-05-28). This PR cherry-picks the complete security set from upstream dspace-9_x:

Advisory	CVE	Severity	Fix	Upstream PR
GHSA-9x82-rm84-c6x7	CVE-2026-49832	HIGH	RCE via Velocity templates used by LDN: secure Velocity engine (`SecureUberspector`, restricted introspection), only allowlisted config exposed to Email/LDN templates	DSpace#12548
GHSA-9qm4-rh6w-pq5x	CVE-2026-49833	medium	Path traversal in LDN message generation: LDN templates restricted to configured path via new `SecureFileAccess` validator	DSpace#12552
GHSA-c827-pw3m-67w7	CVE-2026-49830	medium	ORE aggregated resource URI validation (scheme + host allowlist)	DSpace#12541
GHSA-v66x-68f2-pxf5	CVE-2026-49831	medium	Curation Task Reporter path traversal: curation I/O via `SecureFileAccess`, allowed base paths, `-T`/`-r` CLI-only	DSpace#12552
(hardening)	—	—	`GlobalRequestSecurityFilter` rejecting path-traversal/JSP request patterns	DSpace#12545

Config changes

dspace.cfg: new message.templates.allowed-config allowlist (config keys exposed to Email/LDN Velocity templates)
config/modules/curate.cfg: commented curate.taskfile.base / curate.reporter.base defaults
config/modules/oai.cfg: commented ORE harvester URL-prefix allowlist
config/modules/ldn.cfg area: LDN template path restrictions

Behavioral notes

Email/LDN Velocity templates only see allowlisted config keys — extend message.templates.allowed-config if custom templates reference other ${config...} values.
Curation -T (taskFile) / -r (reporter) options are CLI-only now.
Path-traversal requests return 403 (sitemap test expectations updated).

Note

The rest of the dataquest customer branches are DSpace 7.6.x and received the equivalent 7.6.7 patch set in separate PRs. This branch needed the 9_x variants (jakarta-based + the LDN fixes which only exist in DSpace 8+).

Verification

mvn package (dspace-api + dspace-server-webapp) passes locally.
Full unit + integration test suite runs via CI on this PR.

🤖 Generated with Claude Code

(cherry picked from commit a9314cf) (cherry picked from commit 494ab82)

(cherry picked from commit cf9be85) (cherry picked from commit d56ef58)

(cherry picked from commit 295a046) (cherry picked from commit 5cc964c)

(cherry picked from commit e2e6a79) (cherry picked from commit 616bf13)

(cherry picked from commit 56ae287) (cherry picked from commit b4c40de)

* Safer Velocity configuration * New "message.templates.allowed-config" config * Remove "UnmodifiableConfiguration" in favour of a simple Map of whitelisted Config keys/values * Centralise Velocity config in core Utils * Small javadoc changes (cherry picked from commit b2d6141) (cherry picked from commit 9b4e48f)

(cherry picked from commit 6b66531) (cherry picked from commit 400d95b)

(cherry picked from commit 5803819) (cherry picked from commit f63a615)

(cherry picked from commit c70dc74) (cherry picked from commit e7704d7)

(cherry picked from commit 65092e1)

Includes some central validation that other classes can make use of. However, it may be overly restrictive. And we may need to allow multiple separate absolute base paths for each config? (cherry picked from commit dddabe6) (cherry picked from commit c2c4088)

# Conflicts: # dspace-api/src/main/java/org/dspace/core/LDN.java (cherry picked from commit 8e3c640) (cherry picked from commit aee73a3)

(cherry picked from commit 83bbb35) # Conflicts: # dspace-api/src/main/java/org/dspace/core/LDN.java (cherry picked from commit a734a55)

(cherry picked from commit 8084c92) (cherry picked from commit 128abe8)

(cherry picked from commit 572f952) (cherry picked from commit 1661ef0)

(cherry picked from commit 0be7a77) (cherry picked from commit 2250fd9)

(cherry picked from commit e9cca8e) (cherry picked from commit d722655)

(cherry picked from commit f97b34b) (cherry picked from commit cbcc4d3)

(cherry picked from commit 00e4979) (cherry picked from commit b0130d0)

(cherry picked from commit 6437472) (cherry picked from commit db7337c)

coderabbitai · 2026-06-11T09:29:31Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: bdfde6d7-e399-4bb3-bd88-85f939f7b435

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

kshepherd added 20 commits June 11, 2026 11:15

ORE aggregated resource URI validation

83a9aeb

(cherry picked from commit a9314cf) (cherry picked from commit 494ab82)

Filter requests for JSPs or traversal

4633b6f

(cherry picked from commit cf9be85) (cherry picked from commit d56ef58)

Add additional logging to GlobalRequestSecurityFilter

27a97a8

(cherry picked from commit 295a046) (cherry picked from commit 5cc964c)

Fix import order

2742404

(cherry picked from commit e2e6a79) (cherry picked from commit 616bf13)

Update sitemap traversal test expectations

e19c893

(cherry picked from commit 56ae287) (cherry picked from commit b4c40de)

Better null checking in allowed config props

db617ac

(cherry picked from commit 6b66531) (cherry picked from commit 400d95b)

Access configurationService at runtime, not rely on class setup

c4c0eb3

(cherry picked from commit 5803819) (cherry picked from commit f63a615)

Email configuationService access lazily

75ed92e

(cherry picked from commit c70dc74) (cherry picked from commit e7704d7)

Remove strict mode Velocity engine configuration (allow nulls)

b75125e

(cherry picked from commit 65092e1)

Restrict LDN message templates to configured path

02e940c

# Conflicts: # dspace-api/src/main/java/org/dspace/core/LDN.java (cherry picked from commit 8e3c640) (cherry picked from commit aee73a3)

Use new SecureFileAccess validator for LDN

b0242f0

(cherry picked from commit 83bbb35) # Conflicts: # dspace-api/src/main/java/org/dspace/core/LDN.java (cherry picked from commit a734a55)

Update LDN file path test

3ca64db

(cherry picked from commit 8084c92) (cherry picked from commit 128abe8)

Move curation -r reporter param to CLI only

21dc886

(cherry picked from commit 572f952) (cherry picked from commit 1661ef0)

Improve SecureFileAccess handling

9835178

(cherry picked from commit 0be7a77) (cherry picked from commit 2250fd9)

Require abs path in SecureFileAccess, calc in callers

db200aa

(cherry picked from commit e9cca8e) (cherry picked from commit d722655)

Comment out default curation dir properties

019e131

(cherry picked from commit f97b34b) (cherry picked from commit cbcc4d3)

Move taskfile -T option to CLI script config only

d65cea6

(cherry picked from commit 00e4979) (cherry picked from commit b0130d0)

Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

17b383f

(cherry picked from commit 6437472) (cherry picked from commit db7337c)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336

MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336
milanmajchrak wants to merge 20 commits into
customer/mendelufrom
mendelu/security-patches-9.3

milanmajchrak commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

milanmajchrak commented Jun 11, 2026

Security patches from vanilla DSpace 9.3

Config changes

Behavioral notes

Note

Verification

Uh oh!

coderabbitai Bot commented Jun 11, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants