CVE-2026-49833: Dspace

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. This issue has been patched in versions 8.4, 9.3, and 10.0.

Affected products

• Dspace Dspace: from 8.0-rc1, before 8.4 (fixed in 8.4); from 9.0-rc1, before 9.3 (fixed in 9.3); version 10-rc1 only

Published 2026-09-02. Last modified 2026-09-09.