Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-49830DSpace: ORE resource URI does not validate scheme for non-web resources

Medium 4.4

In plain English

A medium-severity improper input validation in DSpace from DSpace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.5%top 57.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.dspace:dspace-api7.6.7GHSA-c827-pw3m-67w7
Mavenorg.dspace:dspace-api8.4GHSA-c827-pw3m-67w7
Mavenorg.dspace:dspace-api9.3GHSA-c827-pw3m-67w7
Mavenorg.dspace:dspace-api10.0GHSA-c827-pw3m-67w7

Affected products (as reported)

VendorProductVersions
DSpace DSpace < 7.6.7>= 8.0-rc1, < 8.4>= 9.0-rc1, < 9.3= 10-rc1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References