CVE-2025-9554: Owl Carousel 2 Security Vulnerability

CVE-2025-9554 Overview

CVE-2025-9554 is a medium-severity vulnerability affecting the Owl Carousel 2 contributed module for Drupal. The Drupal Security Team published advisory SA-CONTRIB-2025-104 describing the issue in the module maintained by the owl_carousel_2_project. The flaw is reachable over the network without authentication or user interaction and results in limited confidentiality impact. No integrity or availability impact is reported, and no public exploit is known at the time of publication.

Critical Impact
Unauthenticated remote attackers can access information exposed by the Owl Carousel 2 module on affected Drupal sites, though no integrity or availability impact is reported.

Affected Products

Drupal contributed module: Owl Carousel 2 (owl_carousel_2_project/owl_carousel_2)
All versions of Owl Carousel 2 as identified in the vendor advisory
Drupal sites with the Owl Carousel 2 module enabled

Discovery Timeline

2025-10-10 - CVE-2025-9554 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9554

Vulnerability Analysis

CVE-2025-9554 affects the Owl Carousel 2 module, a Drupal contributed module that integrates the Owl Carousel JavaScript library for building responsive carousels. The Drupal Security Advisory SA-CONTRIB-2025-104 categorizes the flaw as an information disclosure issue that can be triggered remotely without prior authentication.

The attack vector is network-based, the attack complexity is low, and no privileges or user interaction are required. The scope remains unchanged, meaning the impact is confined to the vulnerable Drupal component. Only confidentiality is affected; integrity and availability are not impacted.

The NVD entry uses NVD-CWE-noinfo, indicating that a specific Common Weakness Enumeration classification has not been assigned. The EPSS probability is 0.234%, placing exploitation likelihood in the lower percentile range.

Root Cause

The root cause is not disclosed in detail in the public advisory. The Drupal Security Team advisory SA-CONTRIB-2025-104 describes the module as having a defect that permits unauthorized read access to data that should not be exposed to anonymous or low-privileged callers. Site maintainers should consult the vendor advisory for the specific defective code path and the patched release.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to a Drupal site running the Owl Carousel 2 module. The requests target module endpoints or rendered content that expose information the module should have restricted. Because the flaw requires no credentials and no user interaction, automated scanners can enumerate exposed Drupal installations at scale.

No public proof-of-concept code has been released. See the Drupal Security Advisory SA-CONTRIB-2025-104 for technical details available from the vendor.

Detection Methods for CVE-2025-9554

Indicators of Compromise

Unexpected HTTP GET requests to Owl Carousel 2 module paths under /modules/contrib/owl_carousel_2/ or associated routing endpoints
Access log entries showing anonymous requests retrieving carousel configuration or referenced entity data
Web application firewall alerts flagging enumeration of Drupal contributed module endpoints

Detection Strategies

Inventory Drupal sites with drush pm:list and identify installations where owl_carousel_2 is enabled
Compare installed module versions against the fixed release listed in SA-CONTRIB-2025-104
Review web server access logs for anonymous traffic patterns targeting Owl Carousel 2 routes

Monitoring Recommendations

Forward Drupal watchdog and web server logs to a centralized SIEM for correlation across sites
Alert on spikes in anonymous requests to contributed module paths following advisory publication
Track Drupal module version drift across environments to catch unpatched instances quickly

How to Mitigate CVE-2025-9554

Immediate Actions Required

Apply the fixed release of the Owl Carousel 2 module as identified in the Drupal Security Advisory SA-CONTRIB-2025-104
Audit all Drupal sites in the environment for the presence of the Owl Carousel 2 module
Clear Drupal caches after updating with drush cache:rebuild to ensure updated code paths are active

Patch Information

The Drupal Security Team has published advisory SA-CONTRIB-2025-104 with the fixed version details. Refer to the Drupal Security Advisory for the exact patched release and upgrade instructions. Drupal recommends using Composer to update contributed modules: composer update drupal/owl_carousel_2 --with-dependencies.

Workarounds

Disable the Owl Carousel 2 module until the patched version can be deployed if a rapid update is not possible
Restrict anonymous access to Owl Carousel 2 routes at the reverse proxy or web application firewall layer
Remove the module entirely from sites that no longer require carousel functionality

bash

# Update the Owl Carousel 2 module using Composer and rebuild caches
composer update drupal/owl_carousel_2 --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild