[IT-SecNots] [Security-news] Islandora - Moderately critical - Access bypass leading to arbitrary file overwrite - SA-CONTRIB-2026-313

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-313

Project: Islandora  [1]
Project machine name: islandora
Date: 2026-November-04
Security risk: *Moderately critical* 10 ∕ 25
AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass leading to arbitrary file overwrite

Affected versions: <2.19.1
CVE IDs: CVE-2026-122081
Description: 
Islandora does not sufficiently check file update access when processing
media source and derivative uploads. A user with permission to update media
or create derivatives can submit a crafted request to overwrite files they
are not authorized to modify, including private files.

The Islandora Text Extraction submodule also bypasses shared destination URI
and file extension validation when attaching OCR output.

This vulnerability is mitigated by the fact that an attacker must have
permission to update media or to update a node and create media.

Solution: 
Install the latest version:

 * Upgrade to Islandora 2.19.1 [3].

Reported By: 
 * Whippet (VenusTech ADLab) (whippet) [4]

Fixed By: 
 * Annie Oelschlager (annieoelschlager) [5]
 * Joe Corall (joecorall) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/islandora
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/islandora/releases/2.19.1
[4] https://www.drupal.org/u/whippet
[5] https://www.drupal.org/u/annieoelschlager
[6] https://www.drupal.org/u/joecorall
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3634340

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at