---
id: CVE-2026-49830
title: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources
summary: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when
  ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the
  …
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-20
vendor: dspace
product: 'org.dspace:dspace-api'
affected:
  - 'org.dspace:dspace-api <= 7.6.6'
  - 'org.dspace:dspace-api >= 8.0-rc1, <= 8.3'
  - 'org.dspace:dspace-api >= 9.0-rc1, <= 9.2'
  - 'org.dspace:dspace-api = 10-rc1'
patched:
  - 'org.dspace:dspace-api 7.6.7'
  - 'org.dspace:dspace-api 8.4'
  - 'org.dspace:dspace-api 9.3'
  - 'org.dspace:dspace-api 10.0'
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:05:23.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49830'
references:
  - url: 'https://github.com/DSpace/DSpace/pull/12541'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/pull/12542'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/pull/12543'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/security/advisories/GHSA-c827-pw3m-67w7'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c827-pw3m-67w7'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00489
epssPercentile: 0.39419
aliases:
  - GHSA-c827-pw3m-67w7
ecosystem: maven
ingestedAt: '2026-07-08T20:46:41.609Z'
---

## Overview

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49830)

Affected packages:

- `org.dspace:dspace-api <= 7.6.6`
- `org.dspace:dspace-api >= 8.0-rc1, <= 8.3`
- `org.dspace:dspace-api >= 9.0-rc1, <= 9.2`
- `org.dspace:dspace-api = 10-rc1`

Patched in:

- `org.dspace:dspace-api 7.6.7`
- `org.dspace:dspace-api 8.4`
- `org.dspace:dspace-api 9.3`
- `org.dspace:dspace-api 10.0`

Source: https://github.com/advisories/GHSA-c827-pw3m-67w7