CVE-2026-3215: Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3215?
CVE-2026-3215 has a moderately critical severity due to its potential for arbitrary file upload and cross-site scripting.
Which versions of Islandora are affected by CVE-2026-3215?
CVE-2026-3215 affects Islandora versions from 0.0.0 up to but not including 2.17.5.
How do I fix CVE-2026-3215?
To fix CVE-2026-3215, update your Islandora installation to a version that is not affected, specifically version 2.17.5 or higher.
What types of vulnerabilities does CVE-2026-3215 include?
CVE-2026-3215 includes vulnerabilities such as arbitrary file upload and cross-site scripting (XSS).
What potential impact does CVE-2026-3215 have on users?
CVE-2026-3215 can allow attackers to perform unauthorized actions through cross-site scripting, potentially compromising user data and site integrity.