Islandora CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Islandora CVE published 2026-11-04

CVE-2026-122081

CVE-2026-122081 debrief: Islandora insufficiently checks file update access, allowing users with media update or derivative creation permissions to overwrite unauthorized files, including private ones. This vulnerability is exacerbated by the Islandora Text Extraction submodule's bypass of shared destination URI and file extension validation for OCR output. Defenders must verify user permissions, implemen [truncated]