CVE-2026-3215: Drupal Islandora XSS Vulnerability

CVE-2026-3215 Overview

CVE-2026-3215 is a Cross-Site Scripting (XSS) vulnerability affecting Drupal Islandora, a popular digital repository solution built on the Drupal content management system. The vulnerability stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by other users.

This XSS vulnerability enables attackers with low-level privileges to execute arbitrary JavaScript code in the context of victim browsers. When successfully exploited, attackers can steal session cookies, redirect users to malicious sites, deface web content, or perform actions on behalf of authenticated users.

Critical Impact

Authenticated attackers can inject malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, and unauthorized actions within the Islandora digital repository system.

Affected Products

• Drupal Islandora versions 0.0.0 through 2.17.4
• Drupal Islandora versions prior to 2.17.5
• All Islandora installations running vulnerable versions

Discovery Timeline

• 2026-03-25 - CVE-2026-3215 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-3215

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how Islandora handles user-supplied input before incorporating it into dynamically generated web pages.

The vulnerability requires authentication (low privileges) and user interaction to exploit, as indicated by the attack characteristics. When a victim user views a page containing the injected malicious content, the attacker's script executes within the victim's browser session with full access to the page context.

The scope of this vulnerability is changed, meaning the vulnerable component (Islandora) and the impacted component (victim's browser) are different. This allows attackers to affect resources beyond the vulnerable component's security scope, potentially impacting the confidentiality and integrity of user sessions and data across the Drupal installation.

Root Cause

The root cause of CVE-2026-3215 lies in insufficient input validation and output encoding within the Islandora module. User-controlled data is being rendered in web pages without proper sanitization or escaping, allowing HTML and JavaScript injection.

Drupal provides security APIs for sanitizing user input, such as check_plain(), filter_xss(), and the Twig templating engine's automatic escaping. The vulnerable code paths in Islandora fail to properly utilize these protections, allowing raw user input to be embedded directly into rendered output.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an authenticated attacker with low-level privileges to inject malicious content into the Islandora system. The attack requires user interaction—a victim must view or interact with the content containing the malicious payload.

A typical attack scenario involves the attacker identifying an input field or parameter in Islandora that fails to properly sanitize content. The attacker then crafts a payload containing malicious JavaScript and submits it through the vulnerable input vector. When other users, including administrators, view the affected content, the malicious script executes in their browser context.

The vulnerability allows for both stored XSS (where the malicious payload persists in the application) and potentially reflected XSS scenarios, depending on the specific vulnerable endpoints within Islandora.

Detection Methods for CVE-2026-3215

Indicators of Compromise

• Unusual JavaScript execution errors in browser console logs when accessing Islandora pages
• Unexpected outbound network requests from client browsers to unfamiliar domains
• User reports of redirections to external websites when using Islandora features
• Presence of encoded JavaScript payloads or suspicious HTML tags in database content fields
• Session tokens or authentication cookies being transmitted to unauthorized endpoints

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common XSS payload patterns in requests to Islandora endpoints
• Monitor Drupal watchdog logs for suspicious content submissions containing script tags or JavaScript event handlers
• Deploy Content Security Policy (CSP) headers to detect and block unauthorized inline script execution
• Review database content for stored XSS payloads using pattern matching for common attack signatures
• Utilize SentinelOne's behavioral AI to detect anomalous browser activity indicative of XSS exploitation

Monitoring Recommendations

• Enable verbose logging for Islandora module activities and content submissions
• Monitor HTTP response headers for missing or misconfigured security headers (X-XSS-Protection, Content-Security-Policy)
• Set up alerts for user-agent strings or referrer patterns associated with automated XSS scanning tools
• Track changes to content fields within Islandora for injection of suspicious markup

How to Mitigate CVE-2026-3215

Immediate Actions Required

• Upgrade Drupal Islandora to version 2.17.5 or later immediately
• Audit existing content within Islandora for signs of stored XSS payloads
• Implement Content Security Policy (CSP) headers to restrict inline script execution
• Review and restrict user permissions to minimize the attack surface for authenticated users
• Enable Drupal's built-in XSS filtering mechanisms across all input fields

Patch Information

The Drupal security team has released Islandora version 2.17.5 which addresses this vulnerability. Organizations should update to this version or later as soon as possible. The official security advisory is available at the Drupal Security Advisory SA-CONTRIB-2026-016.

Before applying the update, administrators should back up their Drupal installation and database. After updating, clear all Drupal caches and verify that the Islandora module is functioning correctly. Test the update in a staging environment before deploying to production systems.

Workarounds

• Implement strict Content Security Policy headers that disallow inline scripts (script-src 'self')
• Apply input validation at the application layer using Drupal's Security Kit module
• Restrict access to Islandora content creation and editing to trusted users only
• Enable HTTP-only and Secure flags on session cookies to limit the impact of potential cookie theft
• Deploy a Web Application Firewall with XSS detection rules as an additional defense layer

# Configuration example - Add CSP headers in Drupal settings.php
# Add the following to settings.php or use the seckit module
# This restricts script sources and helps mitigate XSS attacks

# Using .htaccess for Apache servers:
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"

# Using Nginx configuration:
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'";

# Verify Islandora version after update:
drush pm-list --filter=islandora --format=table