CVE-2026-49830: 
Java vulnerability analysis and mitigation

CVE-2026-49830 is a local file inclusion vulnerability in DSpace's OAI-ORE Harvester component, where the ORE Ingestion Crosswalk fails to validate URI schemes when ingesting aggregated ORE resources. This allows an attacker with collection administrator privileges to supply malicious URIs (e.g., file:///etc/passwd) that cause the server to ingest local files as bitstreams. Affected versions include DSpace ≤ 7.6.6, 8.0–8.3, 9.0–9.2, and 10-rc1. It was discovered by Pablo Picurelli Ortiz and first published on June 1, 2026, with the advisory added to the GitHub Advisory Database on July 8, 2026. The CVSS v3.1 base score is 4.4 (Moderate) (GitHub Advisory, DSpace Advisory).

The root cause is improper input validation (CWE-20) in the OREIngestionCrosswalk component of the org.dspace:dspace-api Maven package. When a DSpace collection is configured to harvest from an OAI-ORE endpoint, the crosswalk processes resource URIs from the ORE XML without restricting the URI scheme — allowing non-HTTP schemes such as file:// to be resolved. An attacker exploiting this vulnerability must already hold Collection, Community, or Site Administrator privileges (or have obtained stolen credentials), and must either control or compromise the remote OAI harvest endpoint to supply malicious ORE XML containing file:/// URIs pointing to sensitive server-side files (GitHub Advisory, DSpace Advisory).

Successful exploitation results in local file disclosure: arbitrary files readable by the DSpace process (e.g., /etc/passwd, configuration files containing credentials, or private key material) can be ingested as bitstreams and subsequently accessed by the attacker. The impact is limited to confidentiality — there is no integrity or availability impact. While the scope is unchanged and lateral movement is not directly enabled, exposure of configuration files or credentials could facilitate further compromise of the DSpace server or connected systems (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory date. Exploitation requires high privileges (collection administrator access) and high attack complexity, significantly limiting the attacker pool. The CVE status remains "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score or threat actor attribution is currently available (GitHub Advisory, DSpace Advisory).

1. Obtain Privileged Access: Acquire DSpace Collection, Community, or Site Administrator credentials — either through legitimate access, credential theft, or phishing.
2. Control or Compromise an OAI Endpoint: Set up a malicious OAI-PMH server, or compromise an existing trusted OAI harvest source, capable of serving crafted ORE XML responses.
3. Craft Malicious ORE XML: Construct an ORE XML document containing aggregated resource URIs with file:// scheme paths pointing to sensitive server files, e.g., <ore:aggregates rdf:resource="file:///etc/passwd"/>.
4. Configure Harvest Source: In the DSpace admin interface, configure a target collection to use the attacker-controlled OAI endpoint as its harvest source with ORE format enabled.
5. Trigger Harvest: Initiate an OAI-ORE harvest operation for the configured collection, causing the DSpace backend to fetch and ingest the malicious ORE XML.
6. Retrieve Exfiltrated File: Access the newly created bitstream in the DSpace collection, which now contains the contents of the targeted local file (e.g., /etc/passwd) (GitHub Advisory, DSpace Advisory).

• Logs: DSpace server logs showing OAI harvest operations that reference file:// URIs in ORE XML processing; unexpected bitstream creation events associated with harvest jobs in the DSpace audit log.
• File System: Newly created bitstreams in DSpace collections containing content matching sensitive system files (e.g., /etc/passwd, /etc/shadow, application configuration files); unexpected items appearing in collections configured for OAI harvest.
• Network: Outbound connections from the DSpace server to unfamiliar or newly configured OAI harvest endpoints; harvest jobs triggered from unusual IP addresses or at unusual times.
• Configuration: Changes to collection harvest configuration pointing to external or unknown OAI endpoints, particularly if made by accounts not normally performing administrative tasks (GitHub Advisory).

Upgrade to DSpace 7.6.7, 8.4, 9.3, or 10.0, which include the fix developed by Kim Shepherd (@kshepherd) of The Library Code. For installations that cannot upgrade immediately, manually apply the branch-specific patch files available via pull requests #12541 (9.x), #12542 (7.x), and #12543 (8.x) using git apply [patch-file].patch, followed by rebuilding (mvn -U clean package), redeploying (ant update), and restarting Tomcat. As an immediate workaround, disable the ORE ingestion crosswalk in dspace.cfg by commenting out the org.dspace.content.crosswalk.OREIngestionCrosswalk line from the plugin.named.org.dspace.content.crosswalk.IngestionCrosswalk plugin list (DSpace Advisory).

The vulnerability was discovered and reported by Pablo Picurelli Ortiz (@superpegaso2703), a cybersecurity student at Universidad Rey Juan Carlos, and the code fix was developed by Kim Shepherd (@kshepherd) of The Library Code. Multiple DSpace institutional deployments (including several Czech and Slovak university repositories) have already opened security patch pull requests referencing this CVE, indicating active community response to the advisory (DSpace PR #12542, DSpace Advisory).