What is the CVSS score of CVE-2026-49832?

CVE-2026-49832 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Which versions of DSpace are affected by CVE-2026-49832?

DSpace institutional repositories (versions 8.0-9.2) are vulnerable to remote code execution by authenticated administrators, enabling malicious or compromised admins to seize full control of the…. A patch is available.

How to fix or mitigate CVE-2026-49832?

Within 24 hours: Identify all DSpace instances and determine if running versions 8.0-8.3 or 9.0-9.2; audit administrator account activity for suspicious behavior. Within 7 days: Apply patched version from your DSpace vendor. Within 30 days: Review and strengthen administrator access controls, enforce principle of least privilege for admin roles, and audit repository activity logs for unauthorized changes.

DSpace CVE-2026-49832

HIGH

Code Injection (CWE-94)

2026-07-08 https://github.com/DSpace/DSpace

GHSA-9x82-rm84-c6x7

Path Traversal Code Injection Tomcat RCE Java

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Admin credentials required (PR:H) and non-default LDN plus chaining with path traversal raise complexity (AC:H); reflection escapes the template sandbox to run host code, giving S:C and full C/I/A:H.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 21:27 vuln.today

CVE Published

Jul 08, 2026 - 20:25 github-advisory

HIGH 8.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 maven packages depend on org.dspace:dspace-api (7 direct, 3 indirect)

Ecosystem-wide dependent count for version 8.0-rc1.

DescriptionGitHub Advisory

Overview

Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. _This vulnerability impacts DSpace versions 8.0 <= 8.3, 9.0 <= 9.2._ The attacker MUST already have DSpace administrator credentials in order to perform the attack.

This attack is related to the path traversal attack identified in GHSA-9qm4-rh6w-pq5x as it was the impactful part of the "proof-of-concept" attack chain.

Impact

When chained with the LDN Path Traversal Attack identified in GHSA-9qm4-rh6w-pq5x, it may be possible to execute Java directly from Velocity templates using reflection. This is a very high impact vulnerability, but the attack can only be performed by a user that has DSpace Administrator privileges. Disabling LDN (see below) removes all known attack paths.

Velocity is also used for email templating, but there is no known attack path via emails templates. Nonetheless, the patches below also apply to email templates.

Patches

The fix is included in DSpace 8.4, 9.3 and 10.0. Please upgrade to one of these versions or disable LDN (see below)

If users cannot upgrade immediately, it is possible to manually patch their DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 8.x or 9.x.

Pull request for 9.x: https://github.com/DSpace/DSpace/pull/12548 (Downloadable patch file)
Pull request for 8.x: https://github.com/DSpace/DSpace/pull/12549 (Downloadable patch file)

Apply the patch to a DSpace instance

If at all possible, DSpace project maintainers recommend disabling LDN (see below) or upgrading a DSpace site based on the upgrade instructions. However, if users are unable to do so, they can manually apply the above patches to their Space backend as follows:

Download the appropriate patch file to the machine where DSpace backend is running
From the [dspace-src] folder, apply the patch, e.g. git apply [name-of-file].patch
Now, update the application's DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
Rebuild DSpace, e.g. mvn -U clean package (This will recompile all DSpace backend code)
Redeploy DSpace, e.g. ant update (This will copy all newly built code to the application's installation directory). Depending on an application's setup users also may need to copy the updated "server" webapp over to their Tomcat webapps folder.
Restart Tomcat (or runnable JAR)

Workarounds

In dspace.cfg or local.cfg, disable LDN (set ldn.enabled=false) if it is not crucial to the operation of the repository. (NOTE: LDN is disabled by default, so many DSpace sites may not use this feature)
Once users have patched theirr site or upgraded, they may safely enable LDN again.

Resources

This vulnerability is similar to vulnerabilities reported by Velocity itself:

Velocity 2.2. CVE: https://www.cve.org/CVERecord?id=CVE-2020-13936
This was patched in Velocity 2.3, and DSpace already includes this patch.

Credits

Discovered & reported by Pablo Picurelli Ortiz (@superpegaso2703), cybersecurity student at Universidad Rey Juan Carlos. Reported as a possible attack combined with the LDN Path Traversal vulnerability. Code fix developed by Kim Shepherd (@kshepherd) of The Library Code

AnalysisAI

Remote code execution in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated administrator to execute arbitrary Java via Velocity templates used to render COAR Notify/LDN messages, using reflection to escape the templating sandbox. Exploitation requires valid DSpace administrator credentials and is most impactful when chained with the related LDN path-traversal flaw (GHSA-9qm4-rh6w-pq5x). No public exploit identified at time of analysis, and CVSS is 8.0 (High).

Technical ContextAI

DSpace is a Java-based open-source digital repository platform (dspace-api Maven artifact) widely used for institutional and academic repositories. The flaw is a CWE-94 code injection in its use of Apache Velocity, a server-side template engine, to render inbound COAR Notify / Linked Data Notifications (LDN) messages. Velocity templates can reach Java objects, and via reflection an attacker-controlled template can invoke arbitrary Java methods, turning template rendering into arbitrary code execution. This is the same class of issue as Velocity's own CVE-2020-13936 (patched in Velocity 2.3, which DSpace already ships), but here the exposure comes from how DSpace routes LDN content through Velocity rather than from the engine itself. Velocity is also used for email templating, but no attack path via email templates is known.

RemediationAI

Vendor-released patch: upgrade to DSpace 8.4, 9.3, or 10.0 per the official upgrade instructions. If immediate upgrade is not possible, the primary compensating control is to disable LDN by setting ldn.enabled=false in dspace.cfg or local.cfg - this removes all known attack paths and, because LDN is disabled by default, many sites are unaffected already; the trade-off is loss of COAR Notify / LDN interoperability. Alternatively, manually patch the backend using the upstream pull requests (9.x: https://github.com/DSpace/DSpace/pull/12548 with patch https://github.com/DSpace/DSpace/pull/12548.patch; 8.x: https://github.com/DSpace/DSpace/pull/12549 with patch https://github.com/DSpace/DSpace/pull/12549.patch) by running git apply on the patch file from [dspace-src], rebuilding with mvn -U clean package, redeploying with ant update, and restarting Tomcat or the runnable JAR. LDN may safely be re-enabled after patching or upgrading.