Patches to fix 3 security vulnerabilities (November 2026)

Newman, David R and Maulana, Dimas Patches to fix 3 security vulnerabilities (November 2026).

	Patch for "Authenticated server-side file read via symlink in Compressed archive import" - Other Available under License GNU LGPL 3.0. 5kB
	Patch for "Upload from URL deposit hands an unvalidated URL to wget" - Other Available under License GNU LGPL 3.0. 2kB
	Patch for "XML Imports allow XML eXternal Entity (XXE) Injection" - Other Available under License GNU LGPL 3.0. 383kB

Abstract

These patch files are intended to patch three separate security vulnerabilities discovered in October/November and are listed as security advisories on https://github.com/eprints/eprints3.4/security/advisories 1. Authenticated server-side file read via symlink in Compressed archive import 2. Upload from URL deposit hands an unvalidated URL to wget 3. XML Imports allow XML eXternal Entity (XXE) Injection

Requirements

The patch files have been tested for application against EPrints version 3.4.7. They should work against earlier versions of EPrints 3.4.x series assuming the the files being patched have not been modified.

Installation

1. Download each of the three patch files from the command to your EPrints repository server. E.g. wget -P /tmp/ https://files.eprints.org/3333/1/unpack_archive_symlink.patch 2. Change directory to /opt/eprints3/ or whatever your EPrints path is. 3. Run the patch command with each of the three patch files to apply the relevant changes. E.g. patch -p1 < /tmp/unpack_archive_symlink.txt 4. Test that the changes made by the patch files have not broken anything. E.g. /opt/eprints3/bin/epadmin test 5. Reload your Apache webserver and restart the EPrints indexer. E.g. apachectl graceful && /opt/eprints3/bin/indexers top && /opt/eprints3/bin/indexer start 6. Follow the instructions for the "Proof of Concept" or "Confirm Fix" for each of three security advisories described in this abstract to confirm the vulnerability has been patched.

Repository Staff Only: edit this item