CVE-2026-49830
MediumCVSS 4.4Summary
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow local file inclusion via malicious paths like file:///etc/passwd. The attacker must already have DSpace collection administrator privileges.
Risk Assessment
An attacker with collection administrator privileges could read local system files, potentially exposing sensitive information such as passwords. The vulnerability requires existing collection administrator privileges.
Recommendation
Upgrade DSpace to versions 7.6.7, 8.4, 9.3, or 10.0 where the vulnerability is fixed. Additionally, restrict collection administrator privileges and monitor ingestion operations.
Other vulnerabilities in DSpace
See all- CVE-2026-49833Medium
DSpace, a repository application, in versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, has a path traversal vulnerability via the COAR Notify / LDN service. The attacker must already have DSpace administrator credentials. When reading a file input stream of an inbound pattern/template used to generate an LDN message, the LDN class does not check for path traversal or restrict templates to a known base path. This could allow reading and interpreting an untrusted file from elsewhere in the file system as an Apache Velocity template.
- CVE-2026-49832High
DSpace versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 allow Remote Code Execution (RCE) via Velocity Templates used for COAR Notify/LDN messages. Patched in versions 8.4, 9.3, and 10.0.
- CVE-2026-49831Medium
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, in the Curation Task feature allows an output path to be used by the reporter (-r parameter) without restricting it to a base path. This means any path writable by the DSpace (often 'tomcat') user is allowed, constituting a path traversal vulnerability in the curate script.
Original NVD description (English source)
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.