CVE-2026-49832highCWE-94

CVE-2026-49832: falha de alta gravidade em DSpace

DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

Publicada em

Seguir esta CVE+ Monitorar DSpace+ Monitorar org.dspace:dspace-api

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 0.9%
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
DSpace · DSpace
CVEs relacionadas — DSpace

No mesmo produto, das mais perigosas para as menos.

CVE-2021-41189HIGHCommunities and collections administrators can escalate their privilege up to system administratorEPSS 2.1%CVE-2022-31195HIGHPath traversal vulnerability in Simple Archive Format package import in DSpaceEPSS 2.0%CVE-2022-31194HIGHPath traversal vulnerabilities in DSpace JSPUI submission uploadEPSS 1.5%CVE-2022-31190MEDIUMMetadata of withdrawn Items is exposed to anonymous users in DSpace XMLUIEPSS 0.9%CVE-2022-31193HIGHURL Redirection to Untrusted Site in Dspace JSPUIEPSS 0.9%CVE-2022-31191HIGHCross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete toolsEPSS 0.8%