CVE-2026-3215: Drupal Islandora Module URI Path Sanitization Vulnerability
Summary
CVE-2026-3215: This module integrates with Islandora, an open-source digital asset management (DAM) framework. Affects drupal/islandora versions < 2.17.5. Fixed in 2.17.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Islandora module integrates with Islandora, an open-source digital asset management (DAM) framework that allows users to manage and share digital content. It supports various open-source services and can operate in a distributed environment. This module is designed to facilitate the attachment of media to nodes within a Drupal site, enhancing the content management capabilities of users.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of URI paths in the custom route used by the Islandora module for attaching media to nodes. This flaw can lead to cross-site scripting (XSS) attacks and other security issues, potentially allowing attackers to execute malicious scripts in the context of a user's browser. To exploit this vulnerability, an attacker must possess a role with the 'create media' permission and the ability to edit the node to which the media is being attached.
How To Fix
Minimum fixed version
2.17.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the permissions for the 'create media' role to limit access to trusted users only. This can help mitigate the risk of exploitation until the module is updated.
Conclusion
The CVE-2026-3215 vulnerability in the Drupal Islandora module poses a significant risk due to insufficient URI path sanitization. Users are encouraged to update to version 2.17.5 or later to mitigate this risk. Until an update can be applied, restricting permissions can serve as a temporary workaround.
See every vulnerability recorded for drupal/islandora →
FAQ
The vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious scripts in the context of a user's browser.
Any Drupal site using the Islandora module version prior to 2.17.5 is at risk of this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting permissions for the 'create media' role to trusted users to reduce the risk of exploitation.
More information can be found in the official advisory at the Drupal Security Team's advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/islandora.
