Drupal Islandora Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Drupal Islandora module, affecting versions prior to 2.17.5. The issue arises from improper sanitization of URI paths in a custom route used for attaching media to nodes. This lack of proper input handling can lead to XSS and other vulnerabilities. To exploit this issue, an attacker must have a role that allows media creation and the ability to edit the node to which the media is being attached.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users of the Islandora module should upgrade to version 2.17.5.