CVE-2026-49832: DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-09
Weakness: CWE-94

Description

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

Affected products

DSpace: from 8.0-rc1, < 8.4; from 9.0-rc1, < 9.3; = 10-rc1

References

https://github.com/DSpace/DSpace/pull/12548
https://github.com/DSpace/DSpace/pull/12549
https://github.com/DSpace/DSpace/security/advisories/GHSA-9x82-rm84-c6x7

Get alerted when CVE-2026-49832 or the next vulnerability affects your stack