CVE-2026-49832: DSpace RCE Vulnerability via Velocity

CVE-2026-49832 Overview

DSpace is an open source repository application that provides durable access to digital resources. CVE-2026-49832 is a Remote Code Execution (RCE) vulnerability affecting DSpace versions 8.0-rc1 through 8.3, 9.0-rc1 through 9.2, and 10-rc1. The flaw resides in the Velocity Templates used by DSpace to process COAR Notify and Linked Data Notifications (LDN) messages. Authenticated attackers with high privileges can leverage template injection to execute arbitrary code on the underlying server. The DSpace project patched the issue in versions 8.4, 9.3, and 10.0.

Critical Impact
Successful exploitation allows remote code execution on the DSpace application server, compromising confidentiality, integrity, and availability of the repository and any linked systems.

Affected Products

DSpace versions 8.0-rc1 to before 8.4
DSpace versions 9.0-rc1 to before 9.3
DSpace version 10-rc1

Discovery Timeline

2026-09-02 - CVE-2026-49832 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-49832

Vulnerability Analysis

The vulnerability is a server-side template injection classified under CWE-94: Improper Control of Generation of Code. DSpace uses Apache Velocity templates to render COAR Notify and LDN messages. These messages support scholarly communication between repositories and external services. When DSpace processes attacker-influenced content through the Velocity template engine, the engine evaluates embedded directives at render time.

Velocity template contexts frequently expose Java objects that permit reflective access. Attackers who inject template directives can pivot from expression evaluation to invocation of arbitrary Java methods, including Runtime.exec. The result is code execution under the privileges of the DSpace application server process.

Root Cause

The root cause is unsafe handling of untrusted input inside Velocity template rendering for LDN message processing. Input that should be treated as data is instead interpreted as template code. Without a restricted Velocity SecureUberspector or equivalent sandbox, the engine evaluates directives that reach sensitive runtime classes.

Attack Vector

The attack vector is network-based but requires high privileges, indicating the attacker must already hold an authenticated account with permission to submit or influence LDN messages. Attack complexity is high, reflecting non-trivial conditions to reach the vulnerable template path. The scope is changed, meaning exploitation can affect resources beyond the vulnerable component. Public exploit code is not currently available. Technical details are documented in the GitHub Security Advisory GHSA-9x82-rm84-c6x7 and the fix commits in Pull Request #12548 and Pull Request #12549.

Detection Methods for CVE-2026-49832

Indicators of Compromise

Unexpected outbound network connections from the DSpace JVM process to unknown hosts.
Child processes spawned by the DSpace application server such as sh, bash, cmd.exe, or powershell.exe.
Anomalous LDN inbox entries containing Velocity directives such as #set, ${, or references to Runtime, ProcessBuilder, or Class.forName.
New or modified files in DSpace assetstore or webapp directories outside normal deployment activity.

Detection Strategies

Inspect DSpace application logs for Velocity rendering errors or exceptions tied to the LDN inbox endpoints.
Monitor HTTP requests to COAR Notify and LDN endpoints for JSON-LD payloads containing Velocity template syntax.
Correlate authenticated privileged account activity with LDN message submission and subsequent process execution on the host.

Monitoring Recommendations

Enable process-creation auditing on the DSpace host and alert on any child process of the Java servlet container.
Forward web server, servlet container, and DSpace logs to a centralized SIEM for retention and correlation.
Baseline expected LDN sender identities and alert on unexpected sources posting to the inbox.

How to Mitigate CVE-2026-49832

Immediate Actions Required

Upgrade DSpace to version 8.4, 9.3, or 10.0 depending on the deployed branch.
Audit accounts with permission to submit LDN messages and revoke unnecessary privileges.
Review LDN inbox history for suspicious template syntax and investigate any hits.
Restrict network access to COAR Notify and LDN endpoints to trusted peer repositories where feasible.

Patch Information

The DSpace maintainers released fixes in versions 8.4, 9.3, and 10.0. The remediation is tracked in Pull Request #12548 and Pull Request #12549, with coordinated disclosure documented in GHSA-9x82-rm84-c6x7. Administrators running any release-candidate (rc1) build in the affected ranges must upgrade to the corresponding stable release.

Workarounds

If immediate upgrade is not feasible, disable the COAR Notify/LDN integration in the DSpace configuration.
Place a reverse proxy or web application firewall in front of the LDN inbox endpoints and block requests containing Velocity directive patterns.
Run the DSpace servlet container under a least-privileged operating system account to constrain post-exploitation impact.

bash

# Configuration example: disable LDN processing until upgrade is applied
# In dspace.cfg or local.cfg
ldn.enabled = false
coar.notify.enabled = false