CVE-2026-49830
Received Received - Intake

Local File Inclusion in DSpace via ORE Ingestion

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-49830
EUVD
EUVD-2026-70233

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
dspace dspace 7.6.7
dspace dspace 8.4
dspace dspace 9.3
dspace dspace 10.0
dspace dspace to 10.0 (exc)
dspace dspace From 9.0 (inc) to 9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects DSpace open source software versions before 7.6.7, 8.4, 9.3, and 10.0. When ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This allows local file inclusion via malicious paths like file:///etc/passwd. The attacker must have DSpace collection administrator privileges to exploit this.

Detection Guidance

Detection involves checking DSpace versions and configuration. Verify if your DSpace version is below 7.6.7, 8.4, 9.3, or 10.0. Check the dspace.cfg file for ORE Ingestion Crosswalk settings. Look for suspicious OAI endpoints or URI schemes in ingested resources.

Impact Analysis

An attacker with DSpace collection admin privileges could exploit this to access local files or data on the server, leading to unauthorized disclosure. This could include sensitive system files like /etc/passwd. The impact is limited to systems running vulnerable DSpace versions with the ORE Ingestion Crosswalk enabled.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive information. Compliance may be impacted if the vulnerability results in data breaches or unauthorized access to regulated data.

Mitigation Strategies
  • Upgrade DSpace to versions 7.6.7, 8.4, 9.3, or 10.0 or later.
  • Disable the ORE Ingestion Crosswalk in dspace.cfg as a temporary workaround.
  • Apply manual patches from GitHub pull requests #12541, #12542, or #12543 if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart