Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1340

Merged

milanmajchrak merged 18 commits into

dtq-devfrom

dtq-dev-security-patches-7.6.7

Jun 18, 2026

Commits on Jun 18, 2026

ORE aggregated resource URI validation

kshepherd
authored and
milanmajchrak
committed
Velocity and template safety for Email and LDN messages

kshepherd
authored and
milanmajchrak
committed
Better null checking in allowed config props

kshepherd
authored and
milanmajchrak
committed
Access configurationService at runtime, not rely on class setup

kshepherd
authored and
milanmajchrak
committed
Remove strict mode Velocity engine configuration (allow nulls)

kshepherd
authored and
milanmajchrak
committed
Filter requests for JSPs or traversal

kshepherd
authored and
milanmajchrak
committed
Add additional logging to GlobalRequestSecurityFilter

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Update sitemap traversal test expectations

kshepherd
authored and
milanmajchrak
committed
Backport GlobalRequestSecurityFilter for javax

kshepherd
authored and
milanmajchrak
committed
Add secure file access methods

kshepherd
authored and
milanmajchrak
committed
Backport Curation I/O using secure file access

kshepherd
authored and
milanmajchrak
committed
Curation config support for allowed base paths

kshepherd
authored and
milanmajchrak
committed
Move curation -r reporter param to CLI only

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

kshepherd
authored and
milanmajchrak
committed
Move taskfile -T option to CLI script config only

kshepherd
authored and
milanmajchrak
committed
UFAL/Allow lr.help.mail in email template config allowlist

milanmajchrak
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1340

Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1340
milanmajchrak merged 18 commits into
dtq-devfrom
dtq-dev-security-patches-7.6.7

Commits on Jun 18, 2026

ORE aggregated resource URI validation

Velocity and template safety for Email and LDN messages

Better null checking in allowed config props

Access configurationService at runtime, not rely on class setup

Remove strict mode Velocity engine configuration (allow nulls)

Filter requests for JSPs or traversal

Add additional logging to GlobalRequestSecurityFilter

Fix import order

Update sitemap traversal test expectations

Backport GlobalRequestSecurityFilter for javax

Add secure file access methods

Backport Curation I/O using secure file access

Curation config support for allowed base paths

Move curation -r reporter param to CLI only

Fix import order

Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

Move taskfile -T option to CLI script config only

UFAL/Allow lr.help.mail in email template config allowlist