Media Library Importer CVE-2026-81163

Exploitation requires (1) a running Drupal site with the Media Library Importer contributed module installed at a version from 0.0.0 up to and including 2.1.4/below 2.1.6, and (2) a low-privileged authenticated account with access to the module's import functionality (CVSS PR:L - not anonymous). The specific feature or parameter carrying the traversable path is not detailed in the available sources beyond the module's media-import function. Limiting factors: authentication is mandatory (no anonymous exploitation), impact is scoped (S:U) with only partial confidentiality and integrity effect and no availability impact, and the module is a non-core contributed add-on that must be explicitly installed and enabled, so default Drupal installations are not affected.

This is a moderate-severity path traversal (CWE-22) in the Drupal contributed module Media Library Importer, carrying a CVSS 3.1 base of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Multiple signals converge on LOW real-world urgency despite network reachability: EPSS is 0.16% (5th percentile), the CVE is NOT on CISA KEV, no public exploit or PoC reference is provided, and the SSVC decision is Exploitation: none, Automatable: no, Technical Impact: partial. The CVSS vector requires PR:L, so exploitation is authenticated, not anonymous - a meaningful limiter. The vuln.today priority of 'this_month' is consistent with a patch-available, low-probability issue rather than an emergency. No signals conflict: low EPSS, no KEV, and no PoC all align with a non-prioritized, patch-on-normal-cycle item. The main caveats are that this is a Drupal contrib (not core) module, its deployment footprint is narrow, and the advisory text (drupal.org SA-CONTRIB-2026-129) was not fully parsed here, so the precise traversal mechanism and whether it enables read, write, or both is inferred from the CVSS C:L/I:L pairing rather than confirmed from advisory prose.

An attacker with a low-privileged authenticated Drupal account on a site running Media Library Importer ≤2.1.6 submits a crafted import request containing directory-traversal sequences (e.g. ../) in a path parameter, causing the module to read or write files outside its intended media directory. Because CVSS shows only partial confidentiality and integrity impact (C:L/I:L) and no availability impact, the realistic outcome is limited disclosure or modification of specific files rather than full system compromise. No public exploit code is identified at time of analysis, so an attacker would need to develop the exploit from the advisory.