Local File Inclusion Vulnerability in DSpace Repository Software by DSpace
CVE-2026-49830
4.4MEDIUM
What is CVE-2026-49830?
DSpace, an open-source repository application, faces a local file inclusion risk due to inadequate URI scheme validation during the ingestion of aggregated ORE resources. Specifically, prior versions allow an attacker with DSpace collection administrator privileges to exploit this vulnerability by injecting malicious paths, such as 'file:///etc/passwd'. This can lead to unauthorized access to sensitive files within the system. The issue has been addressed in versions 7.6.7, 8.4, 9.3, and 10.0.
Affected Version(s)
DSpace < 7.6.7 < 7.6.7
DSpace >= 8.0-rc1, < 8.4 < 8.0-rc1, 8.4
DSpace >= 9.0-rc1, < 9.3 < 9.0-rc1, 9.3