CVE-2026-49833 Overview
CVE-2026-49833 is a path traversal vulnerability [CWE-22] in DSpace, an open source repository application that provides durable access to digital resources. The flaw resides in the COAR Notify / Linked Data Notifications (LDN) service. When the LDN class reads a file input stream for an inbound pattern or template used to generate an LDN message, it does not validate the path or restrict templates to a known base directory. An authenticated administrator can direct DSpace to read arbitrary files from the host filesystem and interpret them as Apache Velocity templates. Affected versions include 8.0-rc1 through 8.3, 9.0-rc1 through 9.2, and 10-rc1 before 10.0.
Critical Impact
Authenticated administrators can coerce DSpace into reading arbitrary files as Velocity templates, exposing sensitive file contents and enabling template-driven side effects.
Affected Products
- DSpace versions 8.0-rc1 to before 8.4
- DSpace versions 9.0-rc1 to before 9.3
- DSpace versions 10-rc1 to before 10.0
Discovery Timeline
- 2026-09-02 - CVE-2026-49833 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-49833
Vulnerability Analysis
DSpace's COAR Notify integration uses LDN to send notifications about repository events. Message bodies are generated from Apache Velocity templates loaded by the LDN class from disk. The template-loading routine accepts a file path derived from an inbound pattern configuration entry, opens a file input stream, and passes the resulting content to the Velocity engine for rendering.
Because the loader does not canonicalize the path or confine reads to a template base directory, an administrator can supply a value containing ../ sequences or an absolute path pointing outside the intended template folder. Any readable file on the DSpace server, including export logs, bitstream paths, or temporary files, becomes a candidate template. The Velocity engine then parses and evaluates the file, exposing its contents through the resulting LDN message.
Root Cause
The root cause is missing input validation on template paths in the LDN class. The code trusts operator-supplied template identifiers and performs no base-path check before invoking the file input stream. This matches the pattern described by CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
Exploitation requires valid DSpace administrator credentials, which raises the bar but does not eliminate risk in environments with multiple administrators, shared credentials, or compromised admin accounts. An attacker with those credentials configures a COAR Notify inbound pattern or template value that resolves to a target file outside the template directory. When DSpace generates an LDN message, the file is read and processed as a Velocity template. Files that happen to contain Velocity directives may cause additional evaluation side effects during rendering. Refer to the GitHub Security Advisory GHSA-9qm4-rh6w-pq5x for the maintainers' technical description.
Detection Methods for CVE-2026-49833
Indicators of Compromise
- LDN configuration entries whose inbound pattern or template fields contain ../, absolute paths, or references outside the DSpace template directory.
- LDN message payloads that include unexpected content resembling system logs, bitstream data, or temporary file contents.
- Repository logs showing template file reads from paths outside the configured DSpace template base directory.
Detection Strategies
- Audit the DSpace admin API and database for recent changes to COAR Notify inbound patterns and templates.
- Review Velocity rendering errors in application logs, since malformed target files often produce parser exceptions that reveal the attempted file path.
- Correlate administrator authentication events with LDN configuration changes to identify suspicious admin activity.
Monitoring Recommendations
- Monitor filesystem access by the DSpace service account for reads outside the expected template directory.
- Alert on outbound LDN notifications that exceed normal size baselines or contain non-notification content.
- Track administrator account usage and enforce alerting on privileged configuration changes.
How to Mitigate CVE-2026-49833
Immediate Actions Required
- Upgrade DSpace to version 8.4, 9.3, or 10.0, which contain the fix.
- Rotate DSpace administrator credentials and review the administrator account roster for unauthorized entries.
- Inspect current COAR Notify inbound pattern and template configuration for path traversal indicators and remove any suspicious values.
Patch Information
The DSpace maintainers patched the issue in versions 8.4, 9.3, and 10.0. The fixes are tracked in GitHub Pull Request #12540 and GitHub Pull Request #12552. Details are documented in GitHub Security Advisory GHSA-9qm4-rh6w-pq5x.
Workarounds
- Restrict administrator access to trusted personnel and enforce multi-factor authentication on DSpace admin accounts.
- Disable the COAR Notify / LDN service until upgrade is possible if it is not required for repository operations.
- Apply filesystem-level access controls so the DSpace service account cannot read sensitive files outside the repository and template directories.
# Configuration example: verify installed DSpace version and plan upgrade
dspace version
# Expected safe versions: 8.4, 9.3, or 10.0 and later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
