https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T00:01:38.528134+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-129 DRUPAL-CONTRIB-2026-129 2026-10-23T00:01:38.546856+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/media_library_importer

A module to import media files into media library.

The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.

 https://db.gcve.eu/vuln/fkie_cve-2026-81163 fkie_cve-2026-81163 2026-10-23T00:01:38.546921+00:00

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

 https://db.gcve.eu/vuln/ghsa-pm6w-6qr8-q842 GHSA-pm6w-6qr8-q842 2026-10-23T00:01:38.546950+00:00

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

 https://db.gcve.eu/vuln/wid-sec-w-2026-3168 WID-SEC-W-2026-3168 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-23T00:01:38.546966+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Zugriffsbeschränkungen zu umgehen, geschützte oder sensible Inhalte offenzulegen, Benutzerkonten zu übernehmen, unberechtigte Änderungen oder Löschungen vorzunehmen, Zahlungsstatus zu manipulieren sowie Cross-Site-Scripting-Angriffe auszuführen.