Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-25T23:16:56.560Z",
  "pubdate": "2026-08-25T23:16:56.560Z",
  "executiveSummary": "The Media Folders module for Drupal is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from an improper neutralization of user-supplied input during the web page generation process. By injecting malicious scripts into the application, an attacker can ensure that the payload is persistently stored on the server and subsequently executed within the context of an unsuspecting user's browser session. The affected product versions are 0.0.0 through 1.0.8. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized actions on behalf of the user, sensitive information disclosure, or session hijacking. Given the stored nature of this vulnerability, the malicious payload persists across multiple page views, increasing the risk of compromise for administrators or privileged users interacting with the affected media management interface. There are no specific requirements for external network access beyond the ability to submit input to the vulnerable module, making this a significant threat to internal application integrity.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw caused by the insufficient sanitization of user-provided data within the Media Folders module. The root cause lies in the application's failure to properly encode or escape input before rendering it back to the user interface during web page generation. In a Stored XSS scenario, the malicious payload is submitted through a vulnerable input vector—such as folder naming conventions or metadata fields—and subsequently stored within the database without validation. When other users, including site administrators, navigate to a page that renders the stored content, the application serves the malicious script as legitimate part of the page structure. The browser then executes the embedded JavaScript within the security context of the origin site. The attack flow generally involves three distinct stages: injection, storage, and execution. First, an attacker with sufficient permissions to manipulate media folder structures inputs a specially crafted script tag or an HTML attribute containing an 'onmouseover' or 'onerror' event handler. Second, the backend processes this data, failing to strip or neutralize the dangerous characters, and commits the payload to the database. Third, when a victim accesses the media management interface, the server retrieves the malicious entry and incorporates it into the HTML document. Upon rendering, the victim's browser executes the script automatically. Because the script runs in the context of the authenticated user's session, the attacker can perform actions that the user is authorized to execute. Post-exploitation impact includes, but is not limited to, unauthorized modification of site content, exfiltration of CSRF tokens, harvesting of session cookies, and redirection to malicious external domains. This vulnerability affects all versions from 0.0.0 up to and including 1.0.8. The persistence of the payload ensures that even without real-time interaction, any user viewing the tainted folder structure is susceptible to the payload, thereby maximizing the potential reach and impact of the exploit."
}