MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336

Open

milanmajchrak wants to merge 20 commits into

customer/mendelufrom

mendelu/security-patches-9.3

Commits on Jun 11, 2026

ORE aggregated resource URI validation

kshepherd
authored and
milanmajchrak
committed
Filter requests for JSPs or traversal

kshepherd
authored and
milanmajchrak
committed
Add additional logging to GlobalRequestSecurityFilter

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Update sitemap traversal test expectations

kshepherd
authored and
milanmajchrak
committed
Velocity and template safety for Email and LDN messages

kshepherd
authored and
milanmajchrak
committed
Better null checking in allowed config props

kshepherd
authored and
milanmajchrak
committed
Access configurationService at runtime, not rely on class setup

kshepherd
authored and
milanmajchrak
committed
Email configuationService access lazily

kshepherd
authored and
milanmajchrak
committed
Remove strict mode Velocity engine configuration (allow nulls)

kshepherd
authored and
milanmajchrak
committed
Curation I/O path safety

kshepherd
authored and
milanmajchrak
committed
Restrict LDN message templates to configured path

kshepherd
authored and
milanmajchrak
committed
Use new SecureFileAccess validator for LDN

kshepherd
authored and
milanmajchrak
committed
Update LDN file path test

kshepherd
authored and
milanmajchrak
committed
Move curation -r reporter param to CLI only

kshepherd
authored and
milanmajchrak
committed
Improve SecureFileAccess handling

kshepherd
authored and
milanmajchrak
committed
Require abs path in SecureFileAccess, calc in callers

kshepherd
authored and
milanmajchrak
committed
Comment out default curation dir properties

kshepherd
authored and
milanmajchrak
committed
Move taskfile -T option to CLI script config only

kshepherd
authored and
milanmajchrak
committed
Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

kshepherd
authored and
milanmajchrak
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336

MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336
milanmajchrak wants to merge 20 commits into
customer/mendelufrom
mendelu/security-patches-9.3

Commits on Jun 11, 2026

ORE aggregated resource URI validation

Filter requests for JSPs or traversal

Add additional logging to GlobalRequestSecurityFilter

Fix import order

Update sitemap traversal test expectations

Velocity and template safety for Email and LDN messages

Better null checking in allowed config props

Access configurationService at runtime, not rely on class setup

Email configuationService access lazily

Remove strict mode Velocity engine configuration (allow nulls)

Curation I/O path safety

Restrict LDN message templates to configured path

Use new SecureFileAccess validator for LDN

Update LDN file path test

Move curation -r reporter param to CLI only

Improve SecureFileAccess handling

Require abs path in SecureFileAccess, calc in callers

Comment out default curation dir properties

Move taskfile -T option to CLI script config only

Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI