---
id: CVE-2026-49833
title: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources
summary: >-
  DSpace open source software is a repository application which provides durable
  access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to
  before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is
  possible…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-22
vendor: dspace
product: 'org.dspace:dspace-api'
affected:
  - 'org.dspace:dspace-api >= 8.0-rc1, <= 8.3'
  - 'org.dspace:dspace-api >= 9.0-rc1, <= 9.2'
  - 'org.dspace:dspace-api = 10.0-rc1'
patched:
  - 'org.dspace:dspace-api 8.4'
  - 'org.dspace:dspace-api 9.3'
  - 'org.dspace:dspace-api 10.0'
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:05:23.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49833'
references:
  - url: 'https://github.com/DSpace/DSpace/pull/12540'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/pull/12552'
    label: security-advisories@github.com
  - url: 'https://github.com/DSpace/DSpace/security/advisories/GHSA-9qm4-rh6w-pq5x'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-9qm4-rh6w-pq5x'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.0037
epssPercentile: 0.28173
aliases:
  - GHSA-9qm4-rh6w-pq5x
ecosystem: maven
ingestedAt: '2026-07-08T20:46:41.606Z'
---

## Overview

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49833)

Affected packages:

- `org.dspace:dspace-api >= 8.0-rc1, <= 8.3`
- `org.dspace:dspace-api >= 9.0-rc1, <= 9.2`
- `org.dspace:dspace-api = 10.0-rc1`

Patched in:

- `org.dspace:dspace-api 8.4`
- `org.dspace:dspace-api 9.3`
- `org.dspace:dspace-api 10.0`

Source: https://github.com/advisories/GHSA-9qm4-rh6w-pq5x