Live › vulnerability › CVE-2026-81163
Go to dashboardDrupal Media Library Importer has a path traversal flaw that lets a request reach files outside the intended directory. The sources do not say which files an attacker can read or write.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that have the Media Library Importer module installed at version or earlier. The sources do not say which module features or configurations are needed to trigger the flaw, so whether a site without a given feature enabled is safe is unknown.
2.1.6No product ranges from the sources yet.
drush pm:list --filter=media_library_importer or in the Drupal admin under Extend.2.1.6 as affected.2.1.6; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-81163")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.