CVE-2026-49830 DSpace CVE debrief

Who should care

Administrators of DSpace instances, security teams, and developers working with DSpace should be aware of this vulnerability and take action to protect their deployments. This includes reviewing patch guidance, restricting access to DSpace collection administrators, and monitoring for suspicious activity. DSpace collection administrators are at heightened risk due to the privileges required to exploit this vulnerability. Vulnerability management and security teams should review affected scope and prioritize patching efforts accordingly. Platform operators and security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should be updated to reflect the potential impact of this vulnerability on DSpace deployments. Monitoring and detection teams should review relevant logs for exposed assets that need extra review. Exceptions, retesting of remediated assets, and documentation of evidence should be tracked and verified before closing this item. Source tracking and exposure review should also be conducted to ensure comprehensive mitigation of this vulnerability across the organization. Rollback and change window planning may be necessary for affected deployments. This vulnerability affects DSpace instances with specific configurations and versions, so a thorough review of affected scope is necessary to prioritize patching efforts effectively. Compensating controls, such as restricting access to DSpace collection administrators and monitoring for suspicious activity, can help mitigate the risk of exploitation until patching can be completed. Asset inventory and change management processes should be updated to reflect the potential impact of this vulnerability on DSpace deployments. Monitoring and detection teams should review relevant logs for exposed assets that need extra review. Exceptions, retesting of remediated assets, and documentation of evidence should be tracked and verified before closing this item. Source tracking and exposure review should also be conducted to ensure comprehensive mitigation of this vulnerability across the organization. Rollback, 7

Technical summary

DSpace open source software is vulnerable to local file inclusion via malicious paths like file:///etc/passwd when ingesting an aggregated ORE resource by URI. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0. Affected administrators should prioritize patching to prevent potential local file inclusion attacks.

Defensive priority

Administrators of DSpace instances should prioritize patching to prevent potential local file inclusion attacks.

Recommended defensive actions

• Apply patches in versions 7.6.7, 8.4, 9.3, and 10.0.
• Restrict access to DSpace collection administrators.
• Monitor for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates that DSpace open source software is vulnerable to local file inclusion via malicious paths like file:///etc/passwd when ingesting an aggregated ORE resource by URI. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. Evidence is limited to the CVE description and NVD assessment. Defenders should verify affected DSpace deployments, review patch guidance, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.