VDB
Sign up

DRUPAL-CONTRIB-2026-129

Details

A module to import media files into media library.

The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media entity. Files that were deliberately kept outside the webroot, such as a private file store, become downloadable by anonymous visitors at a predictable URL.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/media_library_importer
Introduced in: 0Fixed in: 2.1.6

Upgrade drupal/media_library_importer to 2.1.6 or newer (ecosystem packagist:https://packages.drupal.org/8).

References