CVEvulnerability

CVE-2026-49832

8.0 HIGH Published 2026-09-02 Modified 2026-09-09 Official page ↗
Status
Awaiting Analysis
Published
2026-09-02
Last modified
2026-09-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94

Description

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References