{"action":"Upgrade org.dspace:dspace-api to 7.6.4 (7.x), 8.2 (8.x) or 9.1 (9.x) or later.","affected":[{"fixed":"7.6.4","introduced":"0"},{"fixed":"8.2","introduced":"8.0"},{"fixed":"9.1","introduced":"9.0"}],"component":"org.dspace:dspace-api","cve_ids":["CVE-2025-53621"],"ecosystem":"Maven","epss":0.00436,"exploited":false,"fixed_versions":["7.6.4","8.2","9.1"],"ghsa_id":"GHSA-jjwr-5cfh-7xwh","id":"tcs_01M5N935TS5BJWB5XK8AP1MWDZ","modified_at":"2025-07-15T19:27:23.815530Z","published_at":"2025-07-15T18:04:53Z","references":["https://osv.dev/vulnerability/GHSA-jjwr-5cfh-7xwh","https://github.com/DSpace/DSpace/security/advisories/GHSA-jjwr-5cfh-7xwh","https://nvd.nist.gov/vuln/detail/CVE-2025-53621","https://github.com/DSpace/DSpace/pull/11032","https://github.com/DSpace/DSpace/pull/11032.patch","https://github.com/DSpace/DSpace/pull/11034","https://github.com/DSpace/DSpace/pull/11034.patch","https://github.com/DSpace/DSpace/pull/11035","https://github.com/DSpace/DSpace/pull/11035.patch","https://github.com/DSpace/DSpace"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-jjwr-5cfh-7xwh","url":"https://osv.dev/vulnerability/GHSA-jjwr-5cfh-7xwh"}],"summary":"DSpace is vulnerable to XML External Entity injection during archive imports"}