CVE-2026-49830 Overview
CVE-2026-49830 is a local file inclusion vulnerability in DSpace, an open source repository application that provides durable access to digital resources. The flaw resides in the ORE Ingestion Crosswalk component, which fails to validate the URI scheme when ingesting an aggregated Object Reuse and Exchange (ORE) resource via the OAI-ORE Harvester. An authenticated collection administrator can supply URIs such as file:///etc/passwd to read arbitrary local files from the DSpace host. Maintainers patched the issue in versions 7.6.7, 8.4, 9.3, and 10.0.
Critical Impact
Authenticated DSpace collection administrators can read sensitive local files on the server through crafted ORE URIs, exposing credentials, configuration, and system data.
Affected Products
- DSpace versions prior to 7.6.7
- DSpace 8.x versions prior to 8.4
- DSpace 9.x versions prior to 9.3
Discovery Timeline
- 2026-09-02 - CVE-2026-49830 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-49830
Vulnerability Analysis
The vulnerability affects the OAI-ORE Harvester in DSpace, which imports aggregated resources described by an ORE Resource Map identified by a URI. When the ORE Ingestion Crosswalk processes the supplied URI, it dereferences the location without restricting acceptable URI schemes. Attackers can substitute file:// in place of http:// or https:// to point the harvester at local paths. The crosswalk then reads and processes the local file as if it were a remote ORE document. The weakness is classified as improper input validation [CWE-20].
Root Cause
The root cause is the absence of a URI scheme allowlist in the ORE ingestion path. The harvester assumes external HTTP resources but accepts any URI that the underlying resolver supports, including file, jar, and other schemes exposed by the JVM. Without scheme enforcement, the crosswalk becomes a file read primitive on the DSpace server.
Attack Vector
Exploitation requires DSpace collection administrator privileges, which limits the attacker population but does not eliminate risk in multi-tenant repositories. The attacker configures an OAI-ORE harvest against a target collection and supplies a resource map URI using the file:// scheme pointing to a sensitive path such as /etc/passwd, application configuration, or database credential files. The DSpace process reads the file with the privileges of the running service account and ingests its contents through the crosswalk pipeline. See the GitHub Security Advisory GHSA-c827-pw3m-67w7 for reference details.
Detection Methods for CVE-2026-49830
Indicators of Compromise
- Harvest configuration entries or OAI-ORE requests containing URIs with non-HTTP schemes such as file://, jar://, or netdoc://.
- DSpace application logs recording ORE ingestion attempts referencing local filesystem paths like /etc/passwd, /proc/self/environ, or dspace.cfg.
- Unexpected read access on sensitive files by the DSpace service account near harvest events.
Detection Strategies
- Parse DSpace harvester logs for ORE resource map URIs and alert on any scheme other than http or https.
- Correlate collection administrator authentication events with subsequent harvest configuration changes to surface anomalous administrative activity.
- Deploy file integrity and access monitoring on the DSpace installation directory and system credential files to flag reads by the servlet container process.
Monitoring Recommendations
- Enable verbose logging on the OAIHarvester and ORE crosswalk classes to capture full URI values.
- Forward web server and application logs to a centralized platform for retention and correlation with administrator activity.
- Review the audit trail of collection administrator role assignments and revoke unused privileges.
How to Mitigate CVE-2026-49830
Immediate Actions Required
- Upgrade DSpace to 7.6.7, 8.4, 9.3, or 10.0 as appropriate for your deployment branch.
- Audit the list of accounts holding collection administrator privileges and remove any that are not strictly required.
- Inspect existing harvest configurations for URIs using non-HTTP schemes and remove suspicious entries.
Patch Information
The DSpace maintainers released fixes across supported branches. Review the code changes in GitHub Pull Request #12541, GitHub Pull Request #12542, and GitHub Pull Request #12543. The patches introduce URI scheme validation in the ORE Ingestion Crosswalk so only permitted remote schemes are dereferenced during harvest.
Workarounds
- Disable the OAI-ORE Harvester on repositories that do not require external ORE ingestion until patches are applied.
- Restrict outbound and local filesystem access for the DSpace service account using operating system controls or a mandatory access control profile.
- Run DSpace under a dedicated low-privilege user with no read access to system credential files or unrelated application configuration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
