# CVE-2026-49830: DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.

Source: https://junglewise.ai/threats/cve-2026-49830-dspace-local-file-inclusion-in-oai-ore-harvester  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-49830 · Severity: medium · CVSS 4.4 · Published 2026-09-02

DSpace is an open-source platform used by organizations to manage and preserve digital research and scholarly content. A security flaw in its data harvesting component allows an authorized administrator to trick the system into importing sensitive internal files from the server's hard drive. This could lead to the exposure of private system information or configuration files to unauthorized parties.

Technologies: [org.dspace:dspace-api (Maven)](https://junglewise.ai/threats/technologies/org-dspace-dspace-api). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-49830 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49830 being exploited in the wild.

**How severe is CVE-2026-49830?** Medium severity, with a CVSS score of 4.4, published 2 September 2026.

**Which products and versions are affected?** org.dspace:dspace-api (Maven) ECOSYSTEM:introduced=0,fixed=7.6.7.

**Is there a fix for CVE-2026-49830?** Yes. org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49830 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49830?** Check whether you run org.dspace:dspace-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later

  ```sh
  # set org.dspace:dspace-api to 7.6.7 in your pom.xml or build.gradle
  ```


## Technical details

A local file inclusion (LFI) vulnerability exists in the DSpace ORE Ingestion Crosswalk component. The root cause is a failure to validate URI schemes when ingesting aggregated ORE resources via the OAI-ORE Harvester. An attacker with Collection, Community, or Site Administrator privileges can configure a harvest source to point to local system paths (e.g., using the 'file://' scheme), causing the server to ingest sensitive local files as bitstreams. This can also be exploited if a trusted OAI endpoint is compromised and serves malicious XML. Patches are available in versions 7.6.7, 8.4, 9.3, and 10.0.

## Affected products

- DSpace DSpace <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2, 10-rc1

## Identifiers

- CVE-2026-49830
- GHSA-c827-pw3m-67w7

## Timeline

- 2026-06-01: disclosed: Initial disclosure to DSpace/DSpace repository
- 2026-07-08: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/superpegaso2703](https://api.github.com/users/superpegaso2703)
- [https://github.com/superpegaso2703](https://github.com/superpegaso2703)
- [https://api.github.com/users/superpegaso2703/gists%7B/gist_id%7D](https://api.github.com/users/superpegaso2703/gists%7B/gist_id%7D)
- [https://api.github.com/users/superpegaso2703/repos](https://api.github.com/users/superpegaso2703/repos)
- [https://avatars.githubusercontent.com/u/177873564?v=4](https://avatars.githubusercontent.com/u/177873564?v=4)
- [https://api.github.com/users/superpegaso2703/events%7B/privacy%7D](https://api.github.com/users/superpegaso2703/events%7B/privacy%7D)

## Related threats

- [DSpace path traversal in LDN message generation](https://junglewise.ai/threats/cve-2026-49833-dspace-path-traversal-in-ldn-message-generation)
- [DSpace RCE via Velocity Templates in LDN component](https://junglewise.ai/threats/cve-2026-49832-dspace-rce-via-velocity-templates-in-ldn-component)
- [DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.](https://junglewise.ai/threats/cve-2026-49831-dspace-path-traversal-in-curation-task-reporter)
- [DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format](https://junglewise.ai/threats/cve-2025-53622-dspace-is-vulnerable-to-path-traversal-attacks-when-importing)
- [DSpace is vulnerable to XML External Entity injection during archive imports](https://junglewise.ai/threats/cve-2025-53621-dspace-is-vulnerable-to-xml-external-entity-injection-during)