{"id":"CVE-2016-10726","details":"The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.","aliases":["GHSA-4m9r-5gqp-7j82"],"modified":"2026-07-22T03:44:37.720381Z","published":"2018-07-10T11:29:00.223Z","references":[{"type":"ADVISORY","url":"https://github.com/DSpace/DSpace/releases/tag/dspace-5.5"},{"type":"ADVISORY","url":"https://wiki.duraspace.org/display/DSDOC5x/Release+Notes"},{"type":"FIX","url":"https://jira.duraspace.org/browse/DS-3094"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dspace/dspace","events":[{"introduced":"0"},{"fixed":"6d9b1d753dfb60c77cfa8e43556be400ee4886a1"},{"introduced":"d34e7b89a30b5ffd35556d6fe8936e5d8659415d"},{"fixed":"950e7733617e93d13ea5cca77148023c8098ed95"},{"introduced":"cdf8378320ac546a5e4a3100d3a37fb386600fdf"},{"fixed":"132f37a10ae651725b5750796a8f53ae67664337"}],"database_specific":{"cpe":"cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.6"},{"introduced":"4.0"},{"fixed":"4.5"},{"introduced":"5.0"},{"fixed":"5.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["dspace-5.4","dspace-4.4","dspace-3.5","dspace-5.3","dspace-5.0","dspace-5.2","dspace-5.1","dspace-4.3","dspace-3.4","dspace-4.2","dspace-3.3","dspace-3.3-rc1","dspace-4.1","dspace-4.0","dspace-3.2","dspace-3.1","dspace-3.0","dspace-3.0-rc3","dspace-3.0-rc2","dspace-3.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10726.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}