Islandora EUVD-2026-15474

While CVSS score and CVSS vector are not provided, the CWE-79 classification and broad affected version range (0.0.0 through 2.17.4) indicate significant scope. XSS vulnerabilities in repository systems are typically rated high to critical because they target administrators and researchers who often have elevated privileges and access to sensitive metadata and collections. Without EPSS data or KEV confirmation, real-world exploitation probability cannot be quantified, but XSS flaws are historically among the most commonly exploited and easiest to weaponize. The presence of a Drupal security advisory (SA-CONTRIB-2026-016) and ENISA EUVD tracking (EUVD-2026-15474) suggests coordinated disclosure and vendor awareness. The primary mitigating factor is that Islandora is a specialized digital repository platform with smaller deployment footprint than core Drupal, reducing overall attack surface. However, institutions relying on Islandora for mission-critical collections and metadata should prioritize patching immediately, as authenticated or unauthenticated XSS in repository contexts poses high risk to data integrity and user trust.

An attacker injects a malicious JavaScript payload through a user-editable metadata field or search parameter in an Islandora instance—for example, embedding script tags in an object title or description. When an administrator or another user views the affected object or search results, the unescaped payload executes in their browser, potentially stealing their session cookies, redirecting them to a phishing site, or exfiltrating sensitive information about private collections. No special privileges are required if the input vector is publicly accessible, making this a high-impact, low-barrier attack.