CVE-2026-49833

Name of the Vulnerable Software and Affected Versions DSpace versions 8.0-rc1 through 8.3 DSpace versions 9.0-rc1 through 9.2 DSpace versions 10-rc1 through 10.0-rc1

Description A path traversal issue exists in the COAR Notify / LDN service. An attacker with DSpace administrator credentials can exploit this by providing a malicious path to an inbound pattern or template used to generate LDN messages. Because the LDN class fails to restrict templates to a known base path or validate against path traversal, it may read untrusted files from the file system, such as export logs or temporary files, and interpret them as Apache Velocity templates. This can lead to information disclosure or the execution of arbitrary Java code if the attacker can place a malicious payload in a predictable location on the server.

Recommendations Update DSpace versions 8.0-rc1 through 8.3 to version 8.4. Update DSpace versions 9.0-rc1 through 9.2 to version 9.3. Update DSpace versions 10-rc1 through 10.0-rc1 to version 10.0. As a temporary workaround, disable the LDN service by setting ldn.enabled=false in the dspace.cfg or local.cfg file.