CVE-2026-81163

The Drupal Media Library Importer module (versions 0.0.0 to 2.1.6 ) is vulnerable to a Path Traversal (CWE-22) vulnerability. The root cause is an unvalidated plain text field used for specifying an import folder. An attacker can point this field at any directory readable by the web user, causing...

EUVD-2026-107870

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6...

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...