Kairoaraujo

**Name of the Vulnerable Software and Affected Versions** djehuty versions prior to 26.3.2 **Description** An authenticated depositor can perform a SPARQL injection—a technique used to manipulate queries in a SPARQL endpoint—into a state-modifying (DELETE/INSERT) query. By providing a crafted session name, an attacker can write or delete arbitrary triples within the RDF store. Since the RDF store is shared across all accounts and datasets, this allows for an integrity compromise of the entire repository's metadata. A logged-in account is required, which is easily obtained in typical deployments through self-registration via ORCID/SAML. **Recommendations** Update to version 26.3.2.

**Name of the Vulnerable Software and Affected Versions** djehuty versions prior to 26.3.2 **Description** An unauthenticated attacker can perform SPARQL injection in search and listing queries. This occurs through three separate parameters, allowing the attacker to execute read (SELECT) queries. This can lead to cross-graph data exfiltration, such as retrieving triples from graphs not scoped to the request, including private, internal, or draft data stored in the RDF store. Additionally, it can cause a denial of service by executing expensive or malformed queries that exhaust the resources of the SPARQL backend and web workers. SPARQL is a query language designed to retrieve and manipulate data stored in Resource Description Framework (RDF) format. **Recommendations** Update to version 26.3.2.