CVE-2026-49833
MediumCVSS 5.5Summary
DSpace, a repository application, in versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, has a path traversal vulnerability via the COAR Notify / LDN service. The attacker must already have DSpace administrator credentials. When reading a file input stream of an inbound pattern/template used to generate an LDN message, the LDN class does not check for path traversal or restrict templates to a known base path. This could allow reading and interpreting an untrusted file from elsewhere in the file system as an Apache Velocity template.
Risk Assessment
An attacker with administrator privileges could read arbitrary files from the file system, including sensitive data, and use them as Velocity templates, potentially leading to further attacks. The vulnerability requires existing administrator privileges, limiting the risk.
Recommendation
Upgrade DSpace to versions 8.4, 9.3, or 10.0 where the vulnerability is fixed. Additionally, restrict administrator privileges and monitor LDN activity.
Other vulnerabilities in DSpace
See all- CVE-2026-49832High
DSpace versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 allow Remote Code Execution (RCE) via Velocity Templates used for COAR Notify/LDN messages. Patched in versions 8.4, 9.3, and 10.0.
- CVE-2026-49831Medium
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, in the Curation Task feature allows an output path to be used by the reporter (-r parameter) without restricting it to a base path. This means any path writable by the DSpace (often 'tomcat') user is allowed, constituting a path traversal vulnerability in the curate script.
- CVE-2026-49830Medium
DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow local file inclusion via malicious paths like file:///etc/passwd. The attacker must already have DSpace collection administrator privileges.
Original NVD description (English source)
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.