CVE-2026-49830 json
DSpace: ORE resource URI does not validate scheme for non-web resources
published 2026-07-08 4 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-70233 , GHSA-c827-pw3m-67w7
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
Patch / fix
- maven org.dspace:dspace-api 7.6.7, 8.4, 9.3, 10.0
- duraspace dspace 7.6.7, 8.4, 9.3
- org.dspace dspace-api 7.6.7, 8.4, 9.3
- github.com/DSpace/DSpace#12541 pull request
- github.com/DSpace/DSpace#12542 pull request
- github.com/DSpace/DSpace#12543 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.dspace:dspace-api | <7.6.7 >=8.0-rc1, <8.4 >=9.0-rc1, <9.3 >=10-rc1, <10.0 |
7.6.7 8.4 9.3 10.0 |
Affected products
- DSpace DSpace
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
Sources
- CVE List CVE-2026-49830
- GitHub Advisory GHSA-c827-pw3m-67w7
- NVD CVE-2026-49830
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.