CVE-2026-49832 DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
Attackers can execute arbitrary code via Velocity templates in DSpace's LDN messaging system, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49832?
CVE-2026-49832 is a high-severity code injection vulnerability in DSpace, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-49832?
6 open source packages ship an affected version, including org.dspace:dspace-api.
| Package | Affected | Fixed in |
|---|---|---|
org.dspace:dspace-api Maven | From 10.0-rc1 | 10.0 |
org.dspace:dspace-api Maven | From 10.0-rc1 | 10.0 |
org.dspace:dspace-api Maven | From 8.0-rc1 | 8.4 |
org.dspace:dspace-api Maven | From 8.0-rc1 | 8.4 |
org.dspace:dspace-api Maven | From 9.0-rc1 | 9.3 |
org.dspace:dspace-api Maven | From 9.0-rc1 | 9.3 |
How do I fix CVE-2026-49832?
Upgrade org.dspace:dspace-api to a fixed version for your release line: 10.0, 8.4 or 9.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-49832 being exploited?
There is no known exploitation of CVE-2026-49832 in the wild and no public exploit code.
Sources
Also known as GHSA-9x82-rm84-c6x7.