CVE-2026-49832: 
Java vulnerability analysis and mitigation

CVE-2026-49832 is a Remote Code Execution (RCE) vulnerability in DSpace's Apache Velocity template engine, exploitable via COAR Notify/Linked Data Notifications (LDN) messages. It affects DSpace versions 8.0 through 8.3 and 9.0 through 9.2 (Maven package org.dspace:dspace-api). The vulnerability was discovered and reported by Pablo Picurelli Ortiz, a cybersecurity student at Universidad Rey Juan Carlos, and was published on June 1, 2026, with the GitHub Advisory Database entry updated on July 8, 2026. Exploitation requires DSpace administrator credentials. It carries a CVSS v3.1 base score of 8.0 (High) (GitHub Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / 'Code Injection'): DSpace's Velocity template engine, used to process COAR Notify/LDN messages, does not sufficiently restrict template expressions, allowing an attacker to inject and execute arbitrary Java code via reflection. When chained with the related LDN path traversal vulnerability (GHSA-9qm4-rh6w-pq5x / CWE-22), an authenticated administrator can supply a malicious Velocity template through the LDN interface that executes Java directly on the server. The fix involved implementing safer Velocity engine configuration, introducing a whitelist of allowed configuration keys (message.templates.allowed-config), and centralizing Velocity configuration in core utilities (GitHub Advisory, PR #12548, PR #12549). This vulnerability is analogous to CVE-2020-13936 in Apache Velocity 2.2, which was patched in Velocity 2.3 (already included in DSpace) (GitHub Advisory).

Successful exploitation allows a DSpace administrator to achieve full remote code execution on the server, with high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary Java code via reflection within Velocity templates, potentially enabling data exfiltration, modification or destruction of repository content, and full system compromise. The CVSS scope is marked as "Changed," indicating that the impact can extend beyond the DSpace application itself to the underlying host system (GitHub Advisory).

No public proof-of-concept exploit code has been disclosed, and there is no evidence of in-the-wild exploitation at the time of publication. Exploitation requires high privileges (DSpace administrator credentials) and high attack complexity, as it must be chained with the LDN path traversal vulnerability (GHSA-9qm4-rh6w-pq5x). The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified for this vulnerability (GitHub Advisory, Feedly).

1. Obtain Administrator Credentials: Gain DSpace administrator credentials through phishing, credential stuffing, or another means — this is a hard prerequisite for exploitation.
2. Enable or Confirm LDN is Active: Verify that LDN (Linked Data Notifications) is enabled on the target DSpace instance (it is disabled by default). If not enabled, the primary attack path is unavailable.
3. Chain with Path Traversal (GHSA-9qm4-rh6w-pq5x): Exploit the related LDN path traversal vulnerability to write or reference a malicious Velocity template file in a location accessible to the DSpace LDN message processor.
4. Inject Malicious Velocity Template: Craft a Velocity template payload that uses Java reflection to execute arbitrary code, e.g., invoking Runtime.getRuntime().exec() or similar constructs via Velocity's expression language.
5. Trigger Template Rendering: Submit a COAR Notify/LDN message through the DSpace API that causes the server to render the malicious Velocity template, resulting in server-side code execution.
6. Achieve Objective: Use the resulting code execution to establish persistence, exfiltrate data, or pivot to other systems on the network (GitHub Advisory).

• Logs: Unexpected Java exceptions or stack traces in DSpace server logs related to Velocity template rendering or reflection; unusual LDN/COAR Notify message processing errors in application logs.
• Network: Outbound connections from the DSpace server to unexpected external hosts, particularly following LDN message receipt; unusual HTTP requests to LDN API endpoints from administrator accounts.
• File System: Unexpected or newly created Velocity template files (.vm) in DSpace template directories; new files written to the DSpace installation directory by the application process.
• Process: Unusual child processes spawned by the DSpace Java process (e.g., bash, sh, curl, wget); unexpected network connections initiated by the Tomcat/Java process (GitHub Advisory).

The fix is included in DSpace versions 8.4, 9.3, and 10.0 — upgrading to one of these releases is the recommended remediation (GitHub Advisory). As an immediate workaround, administrators should disable LDN by setting ldn.enabled=false in dspace.cfg or local.cfg; note that LDN is disabled by default, so many sites may already be unaffected. For sites that cannot upgrade immediately, manual patches can be applied using the downloadable patch files from PR #12548 (for 9.x) and PR #12549 (for 8.x), followed by rebuilding (mvn -U clean package), redeploying (ant update), and restarting Tomcat.

The vulnerability was discovered and responsibly disclosed by Pablo Picurelli Ortiz (@superpegaso2703), a cybersecurity student at Universidad Rey Juan Carlos, and the code fix was developed by Kim Shepherd (@kshepherd) of The Library Code. The DSpace project maintainer (tdonohue) published the advisory on June 1, 2026, and the fix was merged into all supported branches on May 27, 2026. A related fork (MENDELU/dataquest-dev) referenced the CVE cluster (CVE-2026-49830 through 49833) in a security patch pull request, indicating awareness in the DSpace community (GitHub Advisory, PR #12548).