CVE-2026-49832: Dspace

High severity, CVSS 8.0. EPSS: 0.9% chance of exploitation in the next 30 days.

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

Affected products

• Dspace Dspace: from 8.0-rc1, before 8.4 (fixed in 8.4); from 9.0-rc1, before 9.3 (fixed in 9.3); version 10-rc1 only

Published 2026-09-02. Last modified 2026-09-09.