DRUPAL-CONTRIB-2026-313

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/islandora/DRUPAL-CONTRIB-2026-313.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-313
Aliases
  • CVE-2026-122081
Published
2026-11-04T17:52:14Z
Modified
2026-11-04T20:30:02Z
Summary
[none]
Details

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.

The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.

This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/islandora

Package

Name
drupal/islandora
Purl
pkg:composer/drupal/islandora?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.19.1
Database specific
Show details 
{
    "constraint": "<2.19.1"
}

Database specific

affected_versions 
"<2.19.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/islandora/DRUPAL-CONTRIB-2026-313.json"