CVE-2026-49830

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...

CVE-2026-49830

DSpace 's OREIngestionCrosswalk (in dspace-api) fails to validate the URI scheme when ingesting an aggregated ORE resource by URI via the OAI-ORE Harvester. An attacker with collection administrator privileges (or via a compromised OAI endpoint) can supply malicious ORE XML containing a file:/// ...