4TUResearchData djehuty up to 26.3.1 session name code injection

Summaryinfo

A vulnerability identified as problematic has been detected in 4TUResearchData djehuty up to 26.3.1. Affected by this issue is some unknown functionality. Performing a manipulation of the argument session name results in code injection. This vulnerability was named CVE-2026-73975. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in 4TUResearchData djehuty up to 26.3.1. This affects some unknown functionality. The manipulation of the argument session name with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on integrity, and availability. The summary by CVE is:

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-73975 since 08/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 26.3.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• 4TUResearchData

Name

• djehuty

Version

• 26.3.0
• 26.3.1

Website

• Product: https://github.com/4TUResearchData/djehuty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion