CVE-2026-49833: 
Java vulnerability analysis and mitigation

CVE-2026-49833 is a path traversal vulnerability in DSpace's COAR Notify / Linked Data Notifications (LDN) service that allows an authenticated DSpace administrator to read arbitrary files from the server's file system and potentially execute arbitrary Java code. It affects DSpace versions 8.0–8.3, 9.0–9.2, and 10.0-rc1 (Maven package org.dspace:dspace-api). The vulnerability was discovered by Pablo Picurelli Ortiz of Universidad Rey Juan Carlos, first published on June 1, 2026, and added to the GitHub Advisory Database on July 8, 2026. It carries a CVSS v3.1 base score of 5.5 (Moderate) (GitHub Advisory, DSpace Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), classified under CAPEC-126 (Path Traversal). When the LDN class reads a file input stream for an "inbound pattern" / "template" used to generate an LDN message, it does not validate or restrict the template file path to the expected base directory ($dspace.dir/config/ldn). An attacker with DSpace administrator credentials can configure an LDN service to reference an arbitrary file path — such as a log file, bitstream, or temporary file — which is then read and interpreted as an Apache Velocity template. As part of a demonstrated attack chain, an attacker can first write a malicious Velocity payload to a predictable location (e.g., a running process's temporary log file) and then reference that path as the LDN template, enabling information disclosure or arbitrary Java code execution via Velocity template injection (GitHub Advisory, DSpace Advisory).

Successful exploitation can lead to high confidentiality impact through unauthorized disclosure of sensitive files from the server's file system (e.g., configuration files, logs, or bitstreams), as well as low integrity and availability impacts. In a more severe chained attack scenario — which has been demonstrated as non-trivial but proven — an attacker can achieve arbitrary Java code execution on the DSpace server by exploiting weaknesses in the Velocity template engine, potentially leading to full server compromise. The attack requires existing DSpace administrator credentials, limiting the exposed population but not eliminating risk in environments with multiple administrators or compromised admin accounts (GitHub Advisory, DSpace Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability requires high privileges (DSpace administrator credentials) and high attack complexity, significantly limiting the attacker pool. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. The attack chain, while proven in a research context, is described as non-trivial to execute (GitHub Advisory, DSpace Advisory).

1. Obtain DSpace Administrator Credentials: The attacker must already possess valid DSpace administrator credentials, either through credential theft, phishing, or compromise of another admin account.
2. Write Malicious Velocity Payload to a Predictable Location: Leverage DSpace administrator capabilities (e.g., triggering an export or log-generating operation) to cause a malicious Apache Velocity template payload to be written to a predictable file path on the server (e.g., a temporary log file or export artifact).
3. Configure a Malicious LDN Service: Using the DSpace administrator interface, create or modify an LDN (Linked Data Notifications) inbound service and set the "inbound pattern" / "template" field to an arbitrary file path pointing to the malicious payload file (e.g., ../../tmp/malicious.log or an absolute path).
4. Trigger LDN Message Generation: Cause the LDN service to process an inbound notification, which triggers the LDN class to read the attacker-specified file path as an Apache Velocity template without path validation.
5. Achieve Information Disclosure or Code Execution: The Velocity engine processes the malicious template, either exfiltrating sensitive file contents (e.g., configuration files, credentials) or executing arbitrary Java code if the Velocity implementation allows it (GitHub Advisory, DSpace Advisory).

• Logs: DSpace server logs showing LDN service configurations referencing file paths outside of $dspace.dir/config/ldn; Velocity template rendering errors or unexpected output in application logs; unusual file access patterns in OS-level audit logs (e.g., auditd) for files outside the DSpace config directory.
• File System: Unexpected or recently modified files in /tmp or other writable directories containing Velocity template syntax (#set, $, #foreach, etc.); new or modified LDN service configurations in the DSpace database referencing non-standard template paths.
• Network: Outbound connections from the DSpace server process to unexpected external hosts following LDN message processing (potential indicator of code execution payload).
• Application: DSpace administrator audit trail showing creation or modification of LDN services with unusual template path values; LDN inbound notification processing events correlated with file reads outside the expected config directory (GitHub Advisory, DSpace Advisory).

Patches are included in DSpace versions 8.4, 9.3, and 10.0 — administrators should upgrade to one of these releases as the primary remediation (GitHub Advisory). For those unable to upgrade immediately, manual patches can be applied: use PR #12540 for DSpace 8.x and PR #12552 for DSpace 9.x (both also fix a related path traversal in the Curation Task reporter). As an immediate workaround, disable LDN by setting ldn.enabled=false in dspace.cfg or local.cfg — note that LDN is disabled by default, so many deployments may already be unaffected. After patching or upgrading, LDN can be safely re-enabled (DSpace Advisory).

The vulnerability was discovered and reported by Pablo Picurelli Ortiz (@superpegaso2703), a cybersecurity student at Universidad Rey Juan Carlos, and the code fix was developed by Kim Shepherd (@kshepherd) of The Library Code. The DSpace project maintainer (tdonohue) published the advisory and coordinated the patch release. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and associated pull requests (GitHub Advisory, DSpace Advisory).