View online: https://www.drupal.org/sa-contrib-2026-313 Project: Islandora [1] Project machine name: islandora Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass leading to arbitrary file overwrite Affected versions: <2.19.1 CVE IDs: CVE-2026-122081 Description: Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output. This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media. Solution: Install the latest version: * Upgrade to Islandora 2.19.1 [3]. Reported By: * Whippet (VenusTech ADLab) (whippet) [4] Fixed By: * Annie Oelschlager (annieoelschlager) [5] * Joe Corall (joecorall) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/islandora [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/islandora/releases/2.19.1 [4] https://www.drupal.org/u/whippet [5] https://www.drupal.org/u/annieoelschlager [6] https://www.drupal.org/u/joecorall [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....