Arbitrary Code Injection Affecting org.dspace:dspace-api package, versions [8.0-rc1,8.4)[9.0-rc1,9.3)[10.0-rc1,10.0)

org.dspace:dspace-api is a DSpace core data model and service APIs.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the Velocity template processing in org.dspace.core.LDN and org.dspace.core.Email. An attacker with DSpace administrator credentials can supply or modify LDN/Velocity template content so the template engine resolves reflective access and executes Java code during LDN message generation. This affects repositories that use LDN message templates, and it can let an authenticated administrator run arbitrary code on the DSpace backend, compromising the server and any data or actions reachable from that process.

Notes

• The vulnerable LDN/email template context exposed the full ConfigurationService object to Velocity, so template authors could access arbitrary configuration keys rather than just the small set intended for message rendering.
• The issue is limited to deployments using the Velocity-based LDN/message-template path; the maintainer's advisory notes that ldn.enabled=false disables the known attack path.

Workarounds

• Disable LDN in dspace.cfg or local.cfg by setting ldn.enabled=false if LDN is not essential; this removes the known attack path for the template RCE issue.
• If you cannot upgrade immediately, manually apply the maintainer-provided patch for your branch to the DSpace backend, then rebuild, redeploy, and restart the backend; this mitigates the vulnerable Velocity template processing used by LDN and email templating.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory