Threat database

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.

CVE-2026-73975 is a high-severity vulnerability in the 4TUResearchData djehuty research data repository system. Before version 26.3.2, authenticated depositors can inject arbitrary SPARQL commands into state-modifying queries by manipulating the session name. This allows them to write or delete arbitrary triples anywhere in the shared RDF store, compromising the integrity of the entire repository metadata. The vulnerability requires a logged-in account, but self-registration via ORCID or SAML lowers the barrier to exploitation. The issue has been fixed in version 26.3.2.