CVE-2026-49830 in DSpace
Summary
by MITRE • 09/02/2026
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
DSpace is a widely deployed open-source software suite designed for managing digital repositories, providing institutions with durable access to scholarly works, datasets, and other digital resources. The security integrity of such platforms relies heavily on the robust validation of inputs during data ingestion processes. A significant vulnerability was identified in the ORE Ingestion Crosswalk component, which is responsible for handling aggregated objects defined by the Open Archives Initiative Object Reuse and Exchange (OAI-ORE) standard. This specific flaw affects versions prior to 7.6.7, 8.4, 9.3, and 10.0 of DSpace. The core technical issue stems from a failure in URI scheme validation when ingesting aggregated ORE resources via the OAI-ORE Harvester using URIs as input identifiers.
The vulnerability manifests because the application does not adequately sanitize or validate the scheme portion of the Uniform Resource Identifier provided during ingestion. By exploiting this lack of validation, an attacker can construct malicious paths that utilize non-standard URI schemes, most notably file:/// to access local filesystem resources. This class of flaw is categorized under CWE-20 Improper Input Validation and specifically aligns with Local File Inclusion (LFI) techniques found in the MITRE ATT&CK framework, where adversaries seek to read sensitive files from the underlying operating system. The ability to specify arbitrary file paths allows for the potential disclosure of critical configuration files, source code, or other sensitive data stored on the server hosting DSpace.
It is crucial to note that this vulnerability requires a high level of pre-existing access within the application environment. An attacker must already possess collection administrator privileges in DSpace to trigger the ingestion process and exploit the flaw. This requirement places the risk profile primarily toward insider threats or external actors who have successfully compromised an administrative account through other means, such as credential theft or privilege escalation. The operational impact of a successful exploitation includes unauthorized access to sensitive server-side files, which can lead further into lateral movement within the network if those files contain database credentials or internal configuration details.
The vulnerability has been addressed in subsequent releases of DSpace, specifically versions 7.6.7, 8.4, 9.3, and 10.0. These updates implement stricter validation logic to ensure that only expected URI schemes are processed during the ORE ingestion workflow. Organizations running affected versions must prioritize upgrading their instances immediately to mitigate this risk. In addition to patching, administrators should enforce strict access controls on administrative accounts, utilize multi-factor authentication where possible, and monitor logs for unusual ingestion patterns involving non-standard URIs as a defensive measure against potential exploitation attempts by compromised users.