CVE-2026-49830: DSpace: ORE resource URI does not validate scheme for non-web resources

A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream.

Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML.