Executive brief
DSpace, an open-source repository software for digital assets, is vulnerable to a remote code execution flaw. An attacker with administrative credentials can exploit the system's notification templates to execute malicious commands on the server. This could lead to a complete takeover of the repository, unauthorized access to sensitive research data, and disruption of institutional operations.
Technical details
A remote code execution vulnerability exists in DSpace due to improper control of generation of code (CWE-94) within Velocity Templates used by the Linked Data Notifications (LDN) component. By chaining this with a previously identified path traversal vulnerability (GHSA-9qm4-rh6w-pq5x), an authenticated attacker with DSpace Administrator privileges can use Java reflection within Velocity templates to execute arbitrary code on the host server. The attack requires the LDN feature to be enabled (it is disabled by default). The vulnerability is addressed in DSpace versions 8.4, 9.3, and 10.0. A temporary workaround is to disable LDN in the configuration files.
Affected products
- DSpace DSpace 8.0 <= 8.3, 9.0 <= 9.2, 10.0-rc1
Timeline
- 2026-06-01: disclosed: Initial disclosure to DSpace maintainers
- 2026-07-08: advisory: GitHub Advisory published
References
- https://api.github.com/users/superpegaso2703
- https://github.com/superpegaso2703
- https://api.github.com/users/superpegaso2703/gists%7B/gist_id%7D
- https://api.github.com/users/superpegaso2703/repos
- https://avatars.githubusercontent.com/u/177873564?v=4
- https://api.github.com/users/superpegaso2703/events%7B/privacy%7D