{"id":"DRUPAL-CONTRIB-2026-313","details":"Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.\n\nThe Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.","aliases":["CVE-2026-122081"],"modified":"2026-11-04T20:30:02.727345002Z","published":"2026-11-04T17:52:14Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-313"}],"affected":[{"package":{"name":"drupal/islandora","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/islandora?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.1"}],"database_specific":{"constraint":"\u003c2.19.1"}}],"database_specific":{"source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/islandora/DRUPAL-CONTRIB-2026-313.json","affected_versions":"\u003c2.19.1"}}],"schema_version":"1.9.2","credits":[{"name":"Whippet (VenusTech ADLab) (whippet)","contact":["https://www.drupal.org/u/whippet"]}]}