CVE-2026-49833
Received Received - Intake

Path Traversal in DSpace via COAR Notify Service

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-49833
EUVD
EUVD-2026-70235

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dspace dspace to 8.4 (exc)
dspace dspace to 9.3 (exc)
dspace dspace to 10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in DSpace open source software affecting versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0. It involves the COAR Notify / LDN service where an attacker with DSpace administrator credentials can exploit path traversal by referencing untrusted files as Velocity templates. The LDN class fails to restrict file paths to a trusted base directory, potentially allowing reading sensitive files or executing arbitrary Java code.

Detection Guidance

Detection requires checking DSpace versions and LDN service configuration. Verify if your DSpace version is between 8.0-rc1 to 8.3, 9.0-rc1 to 9.2, or 10-rc1 to 10.0. Inspect configuration files for LDN service settings and look for unexpected template file references outside trusted directories.

Impact Analysis

An attacker with existing administrator credentials could read sensitive files outside intended directories or execute arbitrary code via crafted Velocity templates. This could lead to data breaches, unauthorized access, or system compromise. The impact is limited to systems where an attacker already has high-privilege access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected DSpace versions may face compliance risks if exploited, resulting in data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade DSpace to versions 8.4, 9.3, or 10.0 if affected. As a temporary measure, disable the LDN feature by setting ldn.enabled=false in configuration files. Remove any untrusted template files and restrict file system access for administrators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart