CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources
A collection administrator can read arbitrary local files by exploiting unvalidated URI schemes during ORE resource ingestion.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49830?
CVE-2026-49830 is a medium-severity path traversal vulnerability in DSpace, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-49830?
8 open source packages ship an affected version, including org.dspace:dspace-api.
| Package | Affected | Fixed in |
|---|---|---|
org.dspace:dspace-api Maven | All versions | 7.6.7 |
org.dspace:dspace-api Maven | All versions | 7.6.7 |
org.dspace:dspace-api Maven | From 10-rc1 | 10.0 |
org.dspace:dspace-api Maven | From 10-rc1 | 10.0 |
org.dspace:dspace-api Maven | From 8.0-rc1 | 8.4 |
org.dspace:dspace-api Maven | From 8.0-rc1 | 8.4 |
2 more packages
org.dspace:dspace-api Maven | From 9.0-rc1 | 9.3 |
org.dspace:dspace-api Maven | From 9.0-rc1 | 9.3 |
How do I fix CVE-2026-49830?
Upgrade org.dspace:dspace-api to a fixed version for your release line: 7.6.7, 10.0, 8.4 or 9.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49830 being exploited?
There is no known exploitation of CVE-2026-49830 in the wild and no public exploit code.
Sources
Also known as GHSA-c827-pw3m-67w7.