Improper access control in Islandora - CVE-2026-122081
Published: November 5, 2026
Vulnerability identifier: #VU159414
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-122081
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected module does not sufficiently check file update access when processing media source and derivative uploads. A remote user can bypass implemented security restrictions and overwrite arbitrary files on the system.
Affected software
Islandora
How to mitigate CVE-2026-122081
Install updates from vendor's website.
Islandora - update to 2.19.1