CVE-2026-122081 json
Islandora does not sufficiently check file update access when processing media source and derivative uploads.
published 2026-11-04 4 d ago modified 2026-11-04 4 d ago also DRUPAL-CONTRIB-2026-313
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.
The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.
This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.
Patch / fix
- packagist drupal/islandora 2.19.1
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/islandora | <2.19.1 |
2.19.1 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.