This flaw allows an authenticated user to inject arbitrary SPARQL into a state‑modifying query when editing a session name. The injected query can INSERT or DELETE any triples in the RDF store, giving the attacker complete control over all metadata that is shared across the entire repository. The attack does not exfiltrate data but changes it, potentially corrupting dataset descriptions, author information, and other critical provenance records.

The vulnerability applies to the 4TUResearchData djehuty repository system in any version before 26.3.2. All earlier releases are affected; version 26.3.2 and later contain the patch.

With a CVSS score of 8.4, this issue is considered high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a logged‑in depositor, but self‑registration via ORCID/SAML lowers the barrier, making many deployments vulnerable. Once authenticated, an attacker can modify or delete any triple, effectively compromising the integrity of all repository metadata. The attack vector is the session editing interface and it relies on the lack of proper SPARQL input validation.