CVE-2026-49830: DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.

CVE-2026-49830 · Severity: medium · CVSS 4.4 · Published 2026-09-02

DSpace is an open-source platform used by organizations to manage and preserve digital research and scholarly content. A security flaw in its data harvesting component allows an authorized administrator to trick the system into importing sensitive internal files from the server's hard drive. This could lead to the exposure of private system information or configuration files to unauthorized parties.

Technologies: org.dspace:dspace-api (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-49830 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49830 being exploited in the wild.
How severe is CVE-2026-49830?
Medium severity, with a CVSS score of 4.4, published 2 September 2026.
Which products and versions are affected?
org.dspace:dspace-api (Maven) ECOSYSTEM:introduced=0,fixed=7.6.7.
Is there a fix for CVE-2026-49830?
Yes. org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49830 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49830?
Check whether you run org.dspace:dspace-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later
    # set org.dspace:dspace-api to 7.6.7 in your pom.xml or build.gradle

Technical details

A local file inclusion (LFI) vulnerability exists in the DSpace ORE Ingestion Crosswalk component. The root cause is a failure to validate URI schemes when ingesting aggregated ORE resources via the OAI-ORE Harvester. An attacker with Collection, Community, or Site Administrator privileges can configure a harvest source to point to local system paths (e.g., using the 'file://' scheme), causing the server to ingest sensitive local files as bitstreams. This can also be exploited if a trusted OAI endpoint is compromised and serves malicious XML. Patches are available in versions 7.6.7, 8.4, 9.3, and 10.0.

Affected products

  • DSpace DSpace <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2, 10-rc1

Identifiers

  • CVE-2026-49830
  • GHSA-c827-pw3m-67w7

Timeline

  • 2026-06-01: disclosed: Initial disclosure to DSpace/DSpace repository
  • 2026-07-08: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.