CVE-2026-13231: Drupal Advanced Content Feedback XSS Flaw

CVE-2026-13231 Overview

CVE-2026-13231 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Drupal Advanced Content Feedback module (admin_feedback). The flaw affects versions 0.0.0 through 2.8.0 of the contributed module. Attackers can inject persistent JavaScript payloads into feedback content that executes in the browsers of users who view the affected pages. Successful exploitation requires user interaction and can lead to session compromise, credential theft, and unauthorized actions performed under the victim's Drupal session context. The Drupal Security Team published details in advisory SA-CONTRIB-2026-051.

Critical Impact
Stored XSS allows attackers to persist malicious JavaScript that executes against every user viewing affected Drupal pages, including administrators.

Affected Products

Drupal Advanced Content Feedback (admin_feedback) module versions 0.0.0 through 2.8.0
Drupal sites with the admin_feedback contributed module enabled
Any Drupal installation permitting untrusted users to submit content feedback

Discovery Timeline

2026-07-10 - CVE-2026-13231 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13231

Vulnerability Analysis

The Advanced Content Feedback module accepts user-submitted feedback data and renders it in administrative or content review interfaces without sufficient output encoding. Because the payload is persisted in the Drupal database, every subsequent page render delivers the malicious script to viewing users. The scope-changed nature of the flaw means injected script executes in the context of the parent Drupal application, granting access to authenticated session cookies, CSRF tokens, and privileged administrative functionality.

Exploitation requires an attacker to submit crafted feedback content and a victim, typically a site administrator or content moderator, to view that content. Because the module is designed to surface feedback to privileged users, targeting administrators is the natural attack path. Chaining this XSS with administrative account takeover can result in module installation, content modification, or full site compromise.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The module fails to apply Drupal's built-in filtering functions such as check_plain(), Xss::filter(), or the #plain_text render array property when displaying stored feedback fields. HTML control characters submitted by users survive persistence and reach the rendered DOM.

Attack Vector

The attack vector is network-based and requires no authentication to submit malicious feedback if the module permits anonymous submissions. An attacker submits feedback containing an HTML or JavaScript payload targeting a Drupal element such as an event handler attribute or <script> tag. When an administrator opens the feedback review interface, the browser parses and executes the payload. Because the module output is delivered in the same origin as the Drupal admin session, the payload inherits full access to administrative APIs.

No verified proof-of-concept code is publicly available. Technical details are documented in the Drupal Security Advisory SA-CONTRIB-2026-051.

Detection Methods for CVE-2026-13231

Indicators of Compromise

Feedback records in the admin_feedback database tables containing HTML tags, javascript: URIs, or event handler attributes such as onerror, onload, or onmouseover
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing content feedback pages
Unexpected creation of Drupal administrative users or modification of role permissions following feedback review sessions
Session cookies for privileged Drupal accounts appearing in referrer logs of external servers

Detection Strategies

Query the module's storage tables for payload signatures using patterns such as <script, onerror=, javascript:, and document.cookie
Monitor web server access logs for POST requests to feedback submission endpoints containing URL-encoded HTML control characters
Enable and review Drupal watchdog logs for anomalous administrative actions correlated with feedback viewing sessions
Deploy Content Security Policy (CSP) reporting to capture inline script violations from administrative pages

Monitoring Recommendations

Alert on Drupal admin user creation, role changes, and module installation events that follow feedback review activity
Track browser-side telemetry from endpoints used by Drupal administrators for signs of script-driven data exfiltration
Baseline normal feedback submission content length and character distribution to flag anomalous payload submissions

How to Mitigate CVE-2026-13231

Immediate Actions Required

Upgrade the Advanced Content Feedback module to a version newer than 2.8.0 as released by the Drupal maintainers
Restrict permission to submit feedback to authenticated, trusted roles until the patch is applied
Audit stored feedback records for existing malicious payloads and purge any suspicious entries
Rotate administrative session credentials for accounts that reviewed feedback while the vulnerability was present

Patch Information

Refer to the Drupal Security Advisory SA-CONTRIB-2026-051 for the fixed release version and upgrade instructions. Apply the vendor-supplied patch through Drupal's standard module update workflow using drush pm:update admin_feedback or the administrative UI.

Workarounds

Disable the admin_feedback module until the patched release can be deployed
Revoke the permission to submit content feedback from anonymous and untrusted authenticated roles
Deploy a strict Content Security Policy that blocks inline scripts on Drupal administrative paths
Place a web application firewall rule in front of the feedback submission endpoint to reject payloads containing HTML tags or JavaScript URI schemes

bash

# Configuration example
drush pm:uninstall admin_feedback
drush config:set system.performance css.preprocess 1
drush cache:rebuild