# CVE-2026-49832: DSpace RCE via Velocity Templates in LDN component

Source: https://junglewise.ai/threats/cve-2026-49832-dspace-rce-via-velocity-templates-in-ldn-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-49832 · Severity: high · CVSS 8 · Published 2026-09-02

DSpace, an open-source repository software for digital assets, is vulnerable to a remote code execution flaw. An attacker with administrative credentials can exploit the system's notification templates to execute malicious commands on the server. This could lead to a complete takeover of the repository, unauthorized access to sensitive research data, and disruption of institutional operations.

Technologies: [org.dspace:dspace-api (Maven)](https://junglewise.ai/threats/technologies/org-dspace-dspace-api). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-49832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49832 being exploited in the wild.

**How severe is CVE-2026-49832?** High severity, with a CVSS score of 8, published 2 September 2026.

**Which products and versions are affected?** org.dspace:dspace-api (Maven) ECOSYSTEM:introduced=8.0-rc1,fixed=8.4.

**Is there a fix for CVE-2026-49832?** Yes. org.dspace:dspace-api (Maven): upgrade to 8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49832 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49832?** Check whether you run org.dspace:dspace-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.dspace:dspace-api (Maven): upgrade to 8.4 or later

  ```sh
  # set org.dspace:dspace-api to 8.4 in your pom.xml or build.gradle
  ```


## Technical details

A remote code execution vulnerability exists in DSpace due to improper control of generation of code (CWE-94) within Velocity Templates used by the Linked Data Notifications (LDN) component. By chaining this with a previously identified path traversal vulnerability (GHSA-9qm4-rh6w-pq5x), an authenticated attacker with DSpace Administrator privileges can use Java reflection within Velocity templates to execute arbitrary code on the host server. The attack requires the LDN feature to be enabled (it is disabled by default). The vulnerability is addressed in DSpace versions 8.4, 9.3, and 10.0. A temporary workaround is to disable LDN in the configuration files.

## Affected products

- DSpace DSpace 8.0 <= 8.3, 9.0 <= 9.2, 10.0-rc1

## Identifiers

- CVE-2026-49832
- GHSA-9x82-rm84-c6x7

## Timeline

- 2026-06-01: disclosed: Initial disclosure to DSpace maintainers
- 2026-07-08: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/superpegaso2703](https://api.github.com/users/superpegaso2703)
- [https://github.com/superpegaso2703](https://github.com/superpegaso2703)
- [https://api.github.com/users/superpegaso2703/gists%7B/gist_id%7D](https://api.github.com/users/superpegaso2703/gists%7B/gist_id%7D)
- [https://api.github.com/users/superpegaso2703/repos](https://api.github.com/users/superpegaso2703/repos)
- [https://avatars.githubusercontent.com/u/177873564?v=4](https://avatars.githubusercontent.com/u/177873564?v=4)
- [https://api.github.com/users/superpegaso2703/events%7B/privacy%7D](https://api.github.com/users/superpegaso2703/events%7B/privacy%7D)

## Related threats

- [DSpace path traversal in LDN message generation](https://junglewise.ai/threats/cve-2026-49833-dspace-path-traversal-in-ldn-message-generation)
- [DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.](https://junglewise.ai/threats/cve-2026-49831-dspace-path-traversal-in-curation-task-reporter)
- [DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.](https://junglewise.ai/threats/cve-2026-49830-dspace-local-file-inclusion-in-oai-ore-harvester)
- [DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format](https://junglewise.ai/threats/cve-2025-53622-dspace-is-vulnerable-to-path-traversal-attacks-when-importing)
- [DSpace is vulnerable to XML External Entity injection during archive imports](https://junglewise.ai/threats/cve-2025-53621-dspace-is-vulnerable-to-xml-external-entity-injection-during)