Description
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
Published: 2026-09-02
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

DSpace repository software, before versions 7.6.7, 8.4, 9.3, and 10.0, accepts aggregated ORE resource URIs without validating their scheme. An attacker with collection administrator rights can supply a malicious URI such as file:///etc/passwd, causing the ORE Ingestion Crosswalk to include local files. The flaw is an input validation issue (CWE-20) that could expose sensitive local filesystem data to privileged users.

Affected Systems

The vulnerability affects DSpace installations running any of the following full releases: 7.6.7 and earlier, 8.4 and earlier, 9.3 and earlier, and 10.0 and earlier. Only systems that use the OAI‑ORE Harvester to ingest aggregated resources are impacted; other components are unaffected.

Risk and Exploitability

The CVSS base score of 4.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. Successful exploitation requires the attacker to already possess collection administrator privileges, so the threat is constrained to users with elevated roles. Nonetheless, the potential to read arbitrary local files warrants prompt mitigation.

Generated by OpenCVE AI on September 3, 2026 at 10:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official DSpace patch that validates URI schemes in the ORE Ingestion Crosswalk (upgrade to 7.6.7, 8.4, 9.3, or 10.0).
  • If a patch cannot be applied immediately, disable the OAI‑ORE Harvester or block ingestion of non‑web schemes to prevent local file inclusion.
  • Review and restrict collection administrator accounts to trusted individuals and enforce strong authentication to limit the attacker’s ability to supply malicious URIs.

Generated by OpenCVE AI on September 3, 2026 at 10:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c827-pw3m-67w7 DSpace: ORE resource URI does not validate scheme for non-web resources
History

Thu, 03 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Dspace
Dspace dspace
Vendors & Products Dspace
Dspace dspace

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. This issue has been patched in versions 7.6.7, 8.4, 9.3, and 10.0.
Title DSpace: ORE resource URI does not validate scheme for non-web resources
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Dspace Dspace
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-03T14:31:36.835Z

Reserved: 2026-06-01T18:50:36.056Z

Link: CVE-2026-49830

cve-icon Vulnrichment

Updated: 2026-09-03T14:05:24.529Z

cve-icon NVD

Status : Received

Published: 2026-09-02T18:19:32.027

Modified: 2026-09-03T15:17:29.467

Link: CVE-2026-49830

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:34:17Z

Weaknesses
  • CWE-20

    Improper Input Validation