PT-2026-137308

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text...