---
id: CVE-2026-49832
title: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources
summary: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources. From versions 8.0-rc1 to before 8.4, versions
  9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is
  possible …
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: dspace
product: 'org.dspace:dspace-api'
affected:
  - 'org.dspace:dspace-api >= 8.0-rc1, < 8.4'
  - 'org.dspace:dspace-api >= 9.0-rc1, < 9.3'
  - 'org.dspace:dspace-api = 10.0-rc1'
patched:
  - 'org.dspace:dspace-api 8.4'
  - 'org.dspace:dspace-api 9.3'
  - 'org.dspace:dspace-api 10.0'
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:05:23.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49832'
references:
  - url: 'https://github.com/DSpace/DSpace/pull/12548'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/pull/12549'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/security/advisories/GHSA-9x82-rm84-c6x7'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-9x82-rm84-c6x7'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00869
epssPercentile: 0.57004
aliases:
  - GHSA-9x82-rm84-c6x7
ecosystem: maven
ingestedAt: '2026-07-08T20:46:41.617Z'
---

## Overview

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49832)

Affected packages:

- `org.dspace:dspace-api >= 8.0-rc1, < 8.4`
- `org.dspace:dspace-api >= 9.0-rc1, < 9.3`
- `org.dspace:dspace-api = 10.0-rc1`

Patched in:

- `org.dspace:dspace-api 8.4`
- `org.dspace:dspace-api 9.3`
- `org.dspace:dspace-api 10.0`

Source: https://github.com/advisories/GHSA-9x82-rm84-c6x7