Read the docs
TI-2026-36736 Aliases CVE-2026-49832GHSA-9x82-rm84-c6x7

DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

Priority LOW 38CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00869 59th percentileScored 2026-11-07
Fix Fixed DSpace (DSpace): 8.4, 9.3org.dspace:dspace-api (Maven): 8.4, 9.3, 10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DSpaceDSpace8.0-rc1 to before 8.4; 9.0-rc1 to before 9.3; = 10-rc18.4, 9.3Patch availableCNA
—org.dspace:dspace-api (Maven)8.0-rc1 to before 8.48.4Patch availableGHSA-9x82-rm84-c6x7
—org.dspace:dspace-api (Maven)9.0-rc1 to before 9.39.3Patch availableGHSA-9x82-rm84-c6x7
—org.dspace:dspace-api (Maven)10.0-rc1 to before 10.010.0Patch availableGHSA-9x82-rm84-c6x7
  • DSpace VendorDSpace Affected 8.0-rc1 to before 8.4; 9.0-rc1 to before 9.3; = 10-rc1 Fixed in 8.4, 9.3 Patch available CNA
  • org.dspace:dspace-api (Maven) Vendor— Affected 8.0-rc1 to before 8.4 Fixed in 8.4 Patch available GHSA-9x82-rm84-c6x7
  • org.dspace:dspace-api (Maven) Vendor— Affected 9.0-rc1 to before 9.3 Fixed in 9.3 Patch available GHSA-9x82-rm84-c6x7
  • org.dspace:dspace-api (Maven) Vendor— Affected 10.0-rc1 to before 10.0 Fixed in 10.0 Patch available GHSA-9x82-rm84-c6x7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*——DSpace
  • cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:* Versions — — ·DSpace

Remediation

  • Fix · CNA DSpace (DSpace) Fixed in 8.4, 9.3
  • Fix · GHSA-9x82-rm84-c6x7 org.dspace:dspace-api (Maven) Fixed in 8.4 Advisory →
  • Fix · GHSA-9x82-rm84-c6x7 org.dspace:dspace-api (Maven) Fixed in 9.3 Advisory →
  • Fix · GHSA-9x82-rm84-c6x7 org.dspace:dspace-api (Maven) Fixed in 10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49832
  2. 2026-10-03 Alias added: GHSA-9x82-rm84-c6x7

References

Other 4

  • TI-2022-13234 Path traversal vulnerabilities in DSpace JSPUI submission upload CVSS 3.1HIGH 8.2
  • TI-2022-13235 Path traversal vulnerability in Simple Archive Format package import in DSpace CVSS 3.1HIGH 7.2
  • TI-2019-04922 SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary… CVSS 3.0HIGH 7.5
  • TI-2016-08766 The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows… CVSS 3.0HIGH 7.5
  • TI-2021-18028 Communities and collections administrators can escalate their privilege up to system administrator CVSS 3.1HIGH 7.2
  • TI-2022-13233 URL Redirection to Untrusted Site in Dspace JSPUI CVSS 3.1HIGH 7.1
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences