high · CVSS v3 7.5

CVE-2026-81163

Drupal Media Library Importer allows path traversal, enabling attackers to read arbitrary files via crafted import requests. The flaw exists

Overview

Drupal Media Library Importer allows path traversal, enabling attackers to read arbitrary files via crafted import requests. The flaw exists in all versions up to 2.1.6 and can be exploited by unauthenticated users. It poses a significant risk to site confidentiality and integrity.

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

Impact

Confidentiality: attackers can read sensitive files such as configuration or user data. Integrity: potential to modify files if write access is granted. Availability: could be used to disrupt services by accessing critical files. Defenders: site administrators and developers are impacted.

Remediation

Upgrade to version 2.1.7 or later. If upgrading is not immediately possible, restrict the import endpoint to authenticated users and enforce strict directory limits. Deploy a web application firewall rule to block path traversal patterns such as '..' and absolute paths.

Risk context

High severity (CVSS 7.5). No EPSS data available. Urgent patching is recommended to mitigate potential data exposure.

Affected products

  • Drupal Media Library Importer 0.0.0-2.1.6

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

Drupal Path Traversal Media Library Importer High Severity Web Application File Access Defensive

← All CVEs

Related CVEs

high

CVE-2026-84918

Drupal Monobank payment API improperly verifies cryptographic signatures, enabling attackers to spoof transaction signatures. The flaw exists in all releases up to 1.0.3, potentially allowing unauthorized fund transfers. Defenders should verify signature logic and apply patches promptly.

View analysis

high

CVE-2026-16648

Drupal Mailer Plus Log versions up to 1.2.7 can log sensitive data such as stolen credentials, exposing them to remote services. Attackers with stolen credentials can exploit this to gain unauthorized access. This vulnerability is high severity.

View analysis

high

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.

View analysis

high

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization flaw that allows delegated Users Admin accounts to delete or modify administrator accounts. This can lead to loss of admin control and deletion of content, compromising the integrity and availability of the platform. The vulnerability affects installations running older AVideo versions.

View analysis