Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
DRUPAL-CONTRIB-2026-129 (CVE-2026-81163)
Vulnerability from drupal – Published: 2026-09-02 16:35 – Updated: 2026-09-02 18:29 – Source website
VLAI
Details
A module to import media files into media library.
The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"affected_versions": "\u003c2.1.6"
},
"package": {
"ecosystem": "Packagist:https://packages.drupal.org/8",
"name": "drupal/media_library_importer"
},
"ranges": [
{
"database_specific": {
"constraint": "\u003c2.1.6"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.6"
}
],
"type": "ECOSYSTEM"
}
],
"severity": []
}
],
"aliases": [
"CVE-2026-81163"
],
"credits": [
{
"contact": [
"https://www.drupal.org/u/marcus_johansson"
],
"name": "Marcus Johansson (marcus_johansson)"
}
],
"details": "A module to import media files into media library.\n\nThe import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.",
"id": "DRUPAL-CONTRIB-2026-129",
"modified": "2026-09-02T18:29:24.000Z",
"published": "2026-09-02T16:35:30.000Z",
"references": [
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2026-129"
}
],
"schema_version": "1.7.0"
}