CVE-2016-10726

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/DSpace/DSpace/releases/tag/dspace-5.5Third Party Advisory
https://jira.duraspace.org/browse/DS-3094Patch, Vendor Advisory
https://wiki.duraspace.org/display/DSDOC5x/Release+NotesVendor Advisory
https://github.com/DSpace/DSpace/releases/tag/dspace-5.5Third Party Advisory
https://jira.duraspace.org/browse/DS-3094Patch, Vendor Advisory
https://wiki.duraspace.org/display/DSDOC5x/Release+NotesVendor Advisory

Timeline

Published: Jul 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-107279.8camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data CVE-2016-107285.3An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direc CVE-2016-107297.8An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid r CVE-2016-10739.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin CVE-2016-107307.8An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda A CVE-2016-107319.8ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the requ CVE-2016-107329.8ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or proc CVE-2016-107339.8ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-107349.8ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-107356.1In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2016-107366.1The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_CVE-2016-107375.4Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.