Vulnerabilities

TI-2026-02778 CVE-2026-3215 · GHSA-jgfr-pvv6-mq43

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

LOW 24

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00179 Published 2026-03-25 Fixed in 2.17.5 CWE-79

TI-2025-18940 CVE-2025-25286 · GHSA-mm6v-68qp-f9fw

Crayfish allows Remote Code Execution via Homarus Authorization header

MEDIUM 51

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01024 Published 2025-02-13 Fixed in 4.1.0 CWE-150

Vulnerabilities

Filters

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Crayfish allows Remote Code Execution via Homarus Authorization header