CVE-2026-49830: DSpace: ORE resource URI does not validate scheme for non-web resources

July 8, 2026

A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream.

Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML.

References

github.com/DSpace/DSpace/pull/12541
github.com/DSpace/DSpace/pull/12542
github.com/DSpace/DSpace/pull/12543
github.com/DSpace/DSpace/security/advisories/GHSA-c827-pw3m-67w7
github.com/advisories/GHSA-c827-pw3m-67w7
nvd.nist.gov/vuln/detail/CVE-2026-49830

Code Behaviors & Features

Detect and mitigate CVE-2026-49830 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →