PT-2026-22087 · Drupal+2 · Islandora+1

Damien Mckenna + 5 · Published 2026-02-25 · Updated 2026-03-30 · CVE-2026-3215

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Islandora versions prior to 2.17.5

Description A flaw exists in Drupal Islandora that allows for Cross-Site Scripting (XSS). The issue stems from insufficient sanitization of URI paths used in a custom route for attaching media to nodes. Exploitation requires an attacker to have the 'create media' permission and the ability to edit the node to which the media is attached. Islandora is an open-source digital asset management (DAM) framework that integrates with various open-source services in a distributed environment. The vulnerable component doesn't properly sanitize input during web page generation.

Recommendations Update to Islandora version 2.17.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3215

DRUPAL-CONTRIB-2026-016

Affected Products

Islandora

Drupal/Islandora

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3215 · Security Note
• https://drupal.org/sa-contrib-2026-016 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-016 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2038620171728806307 · Twitter Post
• https://twitter.com/CVEnew/status/2038618162497737032 · Twitter Post