CVE-2026-122081 Islandora CVE debrief

Who should care

Defenders responsible for Drupal and Islandora deployments should assess exposure and prioritize patching or mitigating this vulnerability to prevent unauthorized file modifications.

Why it matters

CVE-2026-122081 allows users with media update or derivative creation permissions to overwrite unauthorized files. Defenders should verify and restrict user permissions, implement additional access controls, and prioritize patching to prevent exploitation.

• Potential unauthorized file modifications, including private files
• Bypass of shared destination URI and file extension validation for OCR output
• Required verification of user permissions and access controls for media and derivative uploads
• Need for patching or updates to prevent exploitation

Technical summary

The Islandora module for Drupal does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.

Defensive priority

Defenders should prioritize verifying user permissions and access controls for media and derivative uploads, and apply patches or updates as available.

Recommended defensive actions

• Verify and restrict user permissions for media updates and derivative creation
• Implement additional access controls for file uploads and modifications
• Monitor for suspicious media and derivative upload activity
• Apply patches or updates for the Islandora module as available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Islandora module for Drupal does not sufficiently check file update access when processing media source and derivative uploads. This issue allows users with permission to update media or create derivatives to submit crafted requests, potentially overwriting files they are not authorized to modify.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.