SA-CONTRIB-2026-129: Critical severity drupal/media_library_importer vulnerability
A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/media_library_importerto a version that resolves this vulnerability.Fixed in 2.1.6
Event History
Frequently Asked Questions
Which deployments are at risk of exposing non-public files?
Deployments are at risk when the importer can be pointed at a directory readable by the web user that contains files intentionally kept outside the webroot, such as a private file store.
What files can be exposed through an import?
The importer copies every file whose extension matches the selected media type from the chosen directory into the public files directory and publishes it as a Media entity.
How would exposed files be accessible to an attacker?
Imported files become downloadable by anonymous visitors at a predictable public URL.