How severe is CVE-2026-49830?

CVE-2026-49830 has a CVSS score of 4.4/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2026-49830?

CVE-2026-49830 affects the following packages: org.dspace:dspace-api (Maven), org.dspace:dspace-api (Maven), org.dspace:dspace-api (Maven), org.dspace:dspace-api (Maven). Ecosystems affected: Maven.

How do I fix CVE-2026-49830?

Update org.dspace:dspace-api to 7.6.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49830 is resolved across your whole dependency graph.

How do I detect CVE-2026-49830 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.dspace:dspace-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-49830 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2026-49830 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-49830 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-49830?

CVE-2026-49830 has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 42th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-49830?

CVE-2026-49830 is classified as Improper Input Validation (CWE-20). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-49830 published, and has it been updated?

CVE-2026-49830 was published on September 2, 2026 and was last updated on October 21, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

MEDIUM severity

CVE-2026-49830 — dspace-api

MEDIUMFix: DSpace/DSpace#12541

CVE-2026-49830 is a medium-severity (CVSS 4.4) Improper Input Validation vulnerability in org.dspace:dspace-api. A fix is available for org.dspace:dspace-api — see the affected versions and patch details below.

DSpace: ORE resource URI does not validate scheme for non-web resources

Also known asGHSA-c827-pw3m-67w7

Published

Sep 2, 2026

Updated

Oct 21, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-49830.

EPSS Exploitation Probability

via FIRST.org ↗

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs42th percentile — riskier than 42% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected

☕org.dspace:dspace-api☕org.dspace:dspace-api☕org.dspace:dspace-api☕org.dspace:dspace-api

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Overview

When ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. This vulnerability impacts DSpace versions <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack.

Expected behaviour : Only external web resources should be ingested as ORE resources, preferably from the trusted endpoint.

Impact

A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream.

Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML.

Patches

The fix is included in DSpace 7.6.7, 8.4, 9.3 and 10.0. Please upgrade to one of these versions or disable the ORE Crosswalk (see below).

If users cannot upgrade immediately, it is possible to manually patch their DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.x.

Pull request for 9.x: https://github.com/DSpace/DSpace/pull/12541 (Downloadable patch file)
Pull request for 8.x: https://github.com/DSpace/DSpace/pull/12543 (Downloadable patch file)
Pull request for 7.x: https://github.com/DSpace/DSpace/pull/12542 (Downloadable patch file)

Apply the patch to a user's DSpace

If at all possible, we recommend disabling the ORE Crosswalk (see below) or upgrading a user's DSpace site based on the upgrade instructions. However, if they are unable to do so, they can manually apply the above patches to their DSpace backend as follows:

Download the appropriate patch file to the machine where DSpace backend is running
From the [dspace-src] folder, apply the patch, e.g. git apply [name-of-file].patch
Now, update the DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
1. Rebuild DSpace, e.g. mvn -U clean package (This will recompile all DSpace backend code)
2. Redeploy DSpace, e.g. ant update (This will copy all newly built code to their installation directory). Depending on their setup they also may need to copy the updated "server" webapp over to their Tomcat webapps folder.
3. Restart Tomcat (or runnable JAR)

Workarounds

Disable the ORE ingestion crosswalk in dspace.cfg by commenting out or removing it from the list of plugin.named.org.dspace.content.crosswalk.IngestionCrosswalk plugins:

  # Remove or comment out this line
  org.dspace.content.crosswalk.OREIngestionCrosswalk = ore, \

Once they have patched their site or upgraded, they may safely enable the OREIngestionCrosswalk again.

Credits

Discovered & reported by Pablo Picurelli Ortiz (@superpegaso2703), cybersecurity student at Universidad Rey Juan Carlos. Code fix developed by Kim Shepherd (@kshepherd) of The Library Code

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.dspace:dspace-api`	all versions	7.6.7`org.dspace:dspace-api:7.6.7`
☕Maven	`org.dspace:dspace-api`	≥ 8.0-rc1&&< 8.4	8.4`org.dspace:dspace-api:8.4`
☕Maven	`org.dspace:dspace-api`	≥ 9.0-rc1&&< 9.3	9.3`org.dspace:dspace-api:9.3`
☕Maven	`org.dspace:dspace-api`	≥ 10-rc1&&< 10.0	10.0`org.dspace:dspace-api:10.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.dspace:dspace-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.dspace:dspace-api to 7.6.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49830 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

## Overview When ingesting an aggregated ORE resource by URI (using the [OAI-ORE Harvester](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125906/OAI#OAI-OAI-PMH/OAI-OREHarvester(Client))), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like `file:///etc/passwd`. _This vulnerability impacts DSpace versions <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2._ The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. Expected behaviour : Only external web resources should be ingested as O