CVE-2026-49830

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 7.6.7 DSpace versions 8.0 through 8.3 DSpace versions 9.0 through 9.2

Description When ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk fails to validate the URI scheme. This allows an attacker with DSpace collection administrator privileges to perform local file inclusion by providing malicious paths, such as file:///etc/passwd. A remote OAI endpoint configured as a harvest source can supply malicious ORE XML, resulting in local files from the DSpace server being ingested as a bitstream.

Recommendations Update DSpace to version 7.6.7, 8.4, 9.3, or 10.0. As a temporary workaround, disable the ORE ingestion crosswalk in dspace.cfg by removing or commenting out the org.dspace.content.crosswalk.OREIngestionCrosswalk plugin.