CVE-2026-81163: Drupal Media Library Importer Vulnerability Allows Unauthorized File Access
Summary
CVE-2026-81163: A module to import media files into media library. Affects drupal/media_library_importer versions < 2.1.6. Fixed in 2.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Media Library Importer module facilitates the importation of media files into the media library, allowing users to manage and utilize media assets efficiently. This module is designed to enhance the media management capabilities of Drupal, providing a user-friendly interface for importing various media types. However, it has been identified that the module lacks proper validation for the import folder input, which can lead to significant security risks.
Vulnerability Detail
The vulnerability arises from the import folder being a plain text field without any validation. This allows an attacker to specify any directory that the web user can read. Consequently, the importer can copy every file with a matching extension into the public files directory, making them accessible as Media entities. This can lead to sensitive files, which were intended to be kept outside the webroot, becoming publicly downloadable by anonymous users at predictable URLs, posing a serious security risk.
How To Fix
Minimum fixed version
2.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict the permissions of the web user to prevent access to sensitive directories. Additionally, avoid using the import folder feature until the module is updated to the fixed version.
Conclusion
The Drupal Media Library Importer vulnerability (CVE-2026-81163) poses a significant risk by allowing unauthorized access to files. It is crucial to update the module to version 2.1.6 or later to mitigate this risk. Users should also consider implementing temporary workarounds to protect sensitive data until the update is applied.
See every vulnerability recorded for drupal/media_library_importer →
FAQ
CVE-2026-81163 is a vulnerability in the Drupal Media Library Importer module that allows unauthorized access to files that should be kept private.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main risk is that sensitive files can be accessed by anonymous users, potentially leading to data breaches and unauthorized information disclosure.
You can update the module by running the command 'composer require drupal/media_library_importer:^2.1.6' in your terminal.
Yes, you can restrict the web user's permissions and avoid using the import folder feature until the module is updated.
