The flaw allows the curator script to accept an arbitrary output path when the reporter option is used. Because no base‑path restriction is enforced, an attacker can create or overwrite any file that the DSpace process can write, potentially exposing sensitive data or modifying configuration files. The weakness is a classic directory traversal condition (CWE‑22), and the impact is unauthorized file write rather than direct code execution. The CVSS base score of 5.5 reflects this moderate risk of confidentiality or integrity compromise.

DSpace prior to versions 7.6.7, 8.4, 9.3, and 10.0 are affected. Any deployment using those releases is vulnerable until updated to the patched releases.

With a CVSS score of 5.5 the vulnerability is medium severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user or compromised service that can trigger the curator process and supply a crafted output path; this could be achieved remotely if the curation task endpoint is exposed. Exploitation requires write permission for the DSpace system user, which is commonly granted for deployment directories. Once exploited, the attacker could write arbitrary files in writable locations.