CVE-2026-49830

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/DSpace/DSpace/pull/12541
https://github.com/DSpace/DSpace/pull/12542
https://github.com/DSpace/DSpace/pull/12543
https://github.com/DSpace/DSpace/security/advisories/GHSA-c827-pw3m-67w7

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-02 18:19

Updated : 2026-09-09 21:05

NVD link : CVE-2026-49830

Mitre link : CVE-2026-49830

CVE.ORG link : CVE-2026-49830

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-49830", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49830", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T14:06:07.362904Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "DSpace", "product": "DSpace", "versions": [{"status": "affected", "version": "< 7.6.7"}, {"status": "affected", "version": ">= 8.0-rc1, < 8.4"}, {"status": "affected", "version": ">= 9.0-rc1, < 9.3"}, {"status": "affected", "version": "= 10-rc1"}]}]}], "published": "2026-09-02T18:19:32.027", "references": [{"url": "https://github.com/DSpace/DSpace/pull/12541", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/12542", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/pull/12543", "source": "security-advisories@github.com"}, {"url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-c827-pw3m-67w7", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0."}], "lastModified": "2026-09-09T21:05:23.237", "sourceIdentifier": "security-advisories@github.com"}