Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
Impact
This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.
Patches
Upgrade immediately to the latest release of Islandora.
Workarounds
In lieu of an upgrade the following module can be leveraged that will resolve the issue until such a time an upgrade can take place.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Islandora
- Contact community@islandora.ca.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | islandora/islandora | >= 2.0, < 2.4.1 | 2.4.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
-- Platform
- Composer
- Package
islandora/islandora- Disclosed
- 21.07.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m58q-qq5h-mgqq - CC BY 4.0
Vulnerability history: islandora/islandora
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.