CVE-2026-49831 Overview
DSpace is an open source repository application that provides durable access to digital resources. CVE-2026-49831 is a path traversal vulnerability [CWE-22] in the DSpace Curation Task feature. The -r reporter parameter of the curate script accepts an arbitrary output path without validation. An authenticated administrator can direct curation task output to any location writable by the DSpace service account, typically the tomcat user. The issue is fixed in DSpace versions 7.6.7, 8.4, 9.3, and 10.0.
Critical Impact
An attacker with high privileges can write curation task output to arbitrary file system paths, enabling overwrite of application files, configuration tampering, and denial of service against the DSpace host.
Affected Products
- DSpace versions prior to 7.6.7
- DSpace versions prior to 8.4 and 9.3
- DSpace versions prior to 10.0
Discovery Timeline
- 2026-09-02 - CVE-2026-49831 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-49831
Vulnerability Analysis
The DSpace Curation Task subsystem provides scripted maintenance operations against repository items. The curate command line tool exposes a -r reporter parameter that streams status and result output from a running curation task. The reporter accepts a file path and writes task output to that destination.
The implementation does not constrain the reporter path to a designated base directory. It does not canonicalize the supplied path or reject traversal sequences such as ../. As a result, any path writable by the DSpace runtime user is a valid target. On typical deployments the runtime user is tomcat, which owns application binaries, WAR contents, configuration under dspace/config, and log directories.
Root Cause
The root cause is missing input validation on the reporter output path passed to the curation task runner. The code path treats the -r argument as trusted user input and passes it directly to file output routines. There is no allowlist of permitted directories and no rejection of relative traversal segments, which meets the definition of CWE-22 Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires an authenticated actor with permission to invoke curation tasks. The attacker supplies a crafted path to the -r parameter that resolves outside the intended report directory. The curation task runner then writes task output to that location, overwriting any file the DSpace user can modify. This can be used to corrupt DSpace configuration, tamper with deployed application files, or disrupt service availability. Exact exploitation details are described in the GitHub Security Advisory GHSA-v66x-68f2-pxf5.
Detection Methods for CVE-2026-49831
Indicators of Compromise
- Unexpected files created or modified under the DSpace installation, tomcat webapp directories, or system paths writable by the DSpace service account.
- Curation task invocations where the -r argument contains ../ sequences, absolute paths, or paths outside the expected report output directory.
- Modifications to dspace.cfg or files under dspace/config correlated with recent curate script executions.
Detection Strategies
- Audit shell history and process accounting for curate invocations and inspect their -r argument values.
- Enable and review DSpace application logs for curation task executions, including the resolved reporter output path.
- Correlate file integrity monitoring alerts on DSpace directories with curation task execution timestamps.
Monitoring Recommendations
- Deploy file integrity monitoring on DSpace webapp, configuration, and log directories owned by the tomcat user.
- Alert on any write activity by the DSpace service account to paths outside [dspace]/reports or the configured curation output directory.
- Retain and forward catalina.out and DSpace logs to a central SIEM for query and correlation.
How to Mitigate CVE-2026-49831
Immediate Actions Required
- Upgrade DSpace to version 7.6.7, 8.4, 9.3, or 10.0 as appropriate for the deployment branch.
- Restrict operating system permissions of the DSpace runtime user so it cannot write to application binaries, configuration, or system directories.
- Review recent curation task activity and audit for suspicious -r parameter values.
Patch Information
The DSpace project patched the vulnerability across all supported branches. Fix commits are available in Pull Request #12539, Pull Request #12540, and Pull Request #12552. Full remediation details are published in GitHub Security Advisory GHSA-v66x-68f2-pxf5.
Workarounds
- Limit access to the curate script and administrative accounts that can invoke curation tasks to a minimal set of trusted operators.
- Run the DSpace application under a dedicated service account with least-privilege file system permissions.
- Constrain the tomcat user with mandatory access controls such as SELinux or AppArmor profiles that deny writes outside the DSpace data directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
