GHSA-m58q-qq5h-mgqq
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
GHSA-m58q-qq5h-mgqq is a critical vulnerability (CVSS 10.0) in islandora/islandora, published July 21, 2022. No source lists public exploit code. Fixed in islandora/islandora 2.4.1.
- Severity
- 10.0 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.1islandora/islandora +1 more
Description
Impact
This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.
Patches
Upgrade immediately to the latest release of Islandora.
Workarounds
In lieu of an upgrade the following module can be leveraged that will resolve the issue until such a time an upgrade can take place.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Islandora
- Contact community@islandora.ca.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
islandora/islandoraPackagist | 2.0 up to 2.4.1 | 2.4.1 |
islandora/islandoraPackagist | 2.0 up to 2.4.1, plus listed versions 2.0.02.0.12.1.02.1.12.2.02.2.12.3.02.4.0 | 2.4.1 |
What each source reports
GitHub Advisories Score used
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
Impact
This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.
Patches
Upgrade immediately to the latest release of Islandora.
Workarounds
In lieu of an upgrade the following module can be leveraged that will resolve the issue until such a time an upgrade can take place.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Islandora
- Contact community@islandora.ca.
- Record
GHSA-m58q-qq5h-mgqq- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
Impact
This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.
Patches
Upgrade immediately to the latest release of Islandora.
Workarounds
In lieu of an upgrade the following module can be leveraged that will resolve the issue until such a time an upgrade can take place.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Islandora
- Contact community@islandora.ca.
- Record
GHSA-m58q-qq5h-mgqq- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.