# CVE-2026-122081: Islandora access bypass leading to arbitrary file overwrite

Source: https://junglewise.ai/threats/cve-2026-122081-drupal-contrib-2026-313-islandora-does-not-sufficiently-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-122081 · Severity: info · Published 2026-11-04

Islandora is a digital asset management system used by libraries and cultural institutions. A user with permission to update media or create derivatives can exploit insufficient access checks to overwrite files they should not be able to modify, including private files. The Text Extraction submodule compounds this by bypassing validation on OCR output attachment.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Islandora](https://junglewise.ai/threats/technologies/drupal-islandora). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-122081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122081 being exploited in the wild.

**How severe is CVE-2026-122081?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Drupal Islandora before 2.19.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Islandora ECOSYSTEM:introduced=0,fixed=2.19.1.

**Is there a fix for CVE-2026-122081?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Islandora: upgrade to 2.19.1 or later. Until then: This vulnerability requires an attacker to already possess permission to update media or to both update nodes and create media; restrict these permissions to only trusted users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122081 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-122081?** Check whether you run Drupal Islandora or Packagist:Https://Packages.Drupal.Org/8 Drupal/Islandora at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Islandora: upgrade to 2.19.1 or later

This vulnerability requires an attacker to already possess permission to update media or to both update nodes and create media; restrict these permissions to only trusted users.

## Technical details

The vulnerability is an access control bypass in media source and derivative upload processing that fails to verify file modification permissions. An authenticated attacker with media update or node update + media creation permissions can craft requests to overwrite unauthorized files. The Islandora Text Extraction submodule additionally bypasses destination URI and file extension validation, increasing the scope of potential overwrites.

## Affected products

- Drupal Islandora before 2.19.1

## Identifiers

- CVE-2026-122081
- DRUPAL-CONTRIB-2026-313

## Timeline

- 2026-11-04: disclosed

## References

- [https://www.drupal.org/u/whippet](https://www.drupal.org/u/whippet)
- [https://www.drupal.org/sa-contrib-2026-313](https://www.drupal.org/sa-contrib-2026-313)

## Related threats

- [Drupal Islandora advanced search access bypass via AJAX](https://junglewise.ai/threats/cve-2026-84916-drupal-contrib-2026-126-this-islandora-advanced-search-sub-module)
- [DRUPAL-CONTRIB-2026-016 - This module integrates with Islandora, an open-source digital asset management (DAM)…](https://junglewise.ai/threats/cve-2026-3215-drupal-contrib-2026-016-this-module-integrates-with-islandora-an)