Media Library Importer
Monthly
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.