SA-CONTRIB-2026-313: Critical severity composer/drupal/islandora vulnerability
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output. This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/islandorato a version that resolves this vulnerability.Fixed in 2.19.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Islandora deployments are exposed where users are granted permission to update media, or to update a node and create media or derivatives. Those permissions can be abused to overwrite files outside the user's authorized scope, including private files.
What access does an attacker need to exploit it?
The attacker must already have permission to update media, or have permission to update a node and create media. Exploitation requires submitting a crafted request during media-source or derivative upload processing.
Are private files affected?
Yes. A crafted request can overwrite files the user is not authorized to modify, including private files.
Does the Text Extraction submodule introduce additional exposure?
Yes. When attaching OCR output, the Islandora Text Extraction submodule bypasses shared destination URI and file-extension validation.