CVE-2026-49832 in DSpace
Summary
by MITRE • 09/02/2026
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the DSpace open-source repository software represents a critical Remote Code Execution (RCE) flaw rooted in the improper handling of Velocity Templates used for processing COAR Notify/LDN messages. DSpace serves as a widely adopted platform for managing and providing durable access to digital resources, including research data, publications, and archives. The specific attack vector involves the integration of Content-Oriented Archival Repository (COAR) Notification services, which utilize Linked Data Notifications (LDN) to facilitate communication between repositories and external systems regarding metadata changes or resource availability. In versions ranging from 8.0-rc1 up to but not including 8.4, as well as versions 9.0-rc1 through 9.3 and version 10-rc1, the system fails to adequately sanitize or restrict the execution context of Velocity templates when processing these incoming notifications. This architectural oversight allows an attacker who can inject malicious content into a COAR Notify message to execute arbitrary server-side code with the privileges of the DSpace application process.
From a technical perspective, this vulnerability is classified under CWE-94 as Improper Control of Generation of Code (Code Injection). The root cause lies in the dynamic evaluation of Velocity templates where user-controlled or externally supplied data from LDN payloads is interpolated and executed without sufficient validation. When an attacker crafts a malicious COAR Notify message containing specially constructed template directives, such as #set() commands with dangerous Java object instantiation methods like Runtime.getRuntime().exec(), these instructions are processed by the server-side rendering engine. Because DSpace runs on a standard Java servlet container, successful exploitation grants the adversary full control over the underlying operating system environment hosting the repository service. This bypasses traditional web application firewalls and input validation layers that typically protect against SQL injection or cross-site scripting, as the attack targets the backend template processing logic rather than direct HTTP parameter manipulation in public-facing forms.
The operational impact of this vulnerability is severe, effectively resulting in a complete compromise of the affected DSpace instance. An attacker can achieve persistent remote code execution, allowing them to exfiltrate sensitive research data stored within the repository, modify metadata records to alter citation metrics or intellectual property rights, and potentially pivot into internal network segments if the server has broader connectivity. Furthermore, because COAR Notify services are often exposed via public APIs to facilitate interoperability with other institutional repositories and indexing services like Crossref or DataCite, the attack surface is significantly expanded beyond local access requirements. This means that any external entity capable of sending a valid LDN message to the DSpace instance can trigger the vulnerability without needing prior authentication credentials for the main application interface, although some configurations may require specific endpoint exposure.
Mitigation strategies primarily involve upgrading to patched versions immediately. The issue has been resolved in DSpace 8.4, version 9.3, and release 10.0 of the software. These updates implement stricter validation rules on incoming LDN payloads and restrict the Velocity template engine from executing dangerous methods or accessing restricted Java classes during message processing. For organizations unable to upgrade immediately due to dependency constraints, temporary mitigations include disabling the COAR Notify service if it is not actively used for interoperability workflows. Additionally, deploying a Web Application Firewall with rules specifically designed to detect Velocity template injection patterns can provide an additional layer of defense by blocking requests containing suspicious template syntax such as #set or $class references within notification payloads. It is also recommended to review network access controls to ensure that LDN endpoints are not unnecessarily exposed to the public internet, limiting exposure only to trusted peer repositories known for secure practices.
This vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically under sub-techniques involving server-side script interpretation such as Velocity or Groovy scripting engines often found in Java-based enterprise applications. The exploitation path reflects common patterns seen in modern web application architectures where dynamic content generation is coupled with external data ingestion points. Security teams should conduct a thorough inventory of their DSpace deployments to identify any instances running vulnerable versions, particularly those configured for open interoperability features. Regular vulnerability scanning and penetration testing focused on API endpoints that handle metadata exchange protocols are essential components of maintaining the integrity of digital repository infrastructure. By addressing this flaw promptly, institutions can prevent unauthorized access to sensitive academic and research assets while ensuring compliance with data protection standards governing scholarly communication systems.