Threats tagged 'drupal-contrib-2026-313'

Islandora versions prior to 2.19.1 have an insufficient check on file update access during media source and derivative uploads. This allows users with permissions to update media or create derivatives to overwrite files they are not authorized to modify, including private files. The Text Extraction submodule further bypasses validation of shared destination URIs and file extensions when attaching OCR output. Exploitation requires existing permissions to update media or nodes and create media. A fix is available in version 2.19.1.