DRUPAL-CONTRIB-2026-313: Composer/drupal/islandora vulnerability
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.
The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.
This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/islandorato a version that resolves this vulnerability.Fixed in 2.19.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using Islandora are exposed where users have permission to update media, or can update a node and create media. Those permissions may allow crafted requests to overwrite files the user is not otherwise authorized to modify, including private files.
What does an attacker need to exploit the vulnerability?
An attacker needs authenticated permissions to update media, or a combination of permission to update a node and create media. The issue is mitigated because it is not described as exploitable by users without those permissions.
Are private files affected?
Yes. Crafted requests can overwrite files the attacker is not authorized to modify, including private files.
Does the Text Extraction submodule introduce an additional concern?
Yes. Islandora Text Extraction bypasses shared destination URI and file-extension validation when attaching OCR output, which affects the validation applied to those attachments.