CVE-2026-16638: Drupal Media Folders Stored XSS Vulnerability

CVE-2026-16638 Overview

CVE-2026-16638 is a stored cross-site scripting (XSS) vulnerability in the Drupal Media Folders contributed module. The flaw affects Media Folders versions 0.0.0 through 1.0.8 and stems from improper neutralization of input during web page generation [CWE-79]. Attackers can inject persistent script payloads that execute in the browsers of users who view affected pages. Successful exploitation requires user interaction but no authentication, and the scope changes because injected scripts execute in the context of the Drupal site. Impact includes session compromise, credential theft, and unauthorized actions performed on behalf of authenticated administrators.

Critical Impact
Attackers can store malicious JavaScript within Media Folders content that executes when administrators or other users view affected pages, enabling session hijacking and privilege abuse in Drupal sites.

Affected Products

Drupal Media Folders module versions 0.0.0 to 1.0.8
Drupal sites with the Media Folders contributed module enabled
Any downstream distributions bundling vulnerable Media Folders releases

Discovery Timeline

2026-08-25 - CVE-2026-16638 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16638

Vulnerability Analysis

The Media Folders module extends Drupal's media library with folder-based organization. The vulnerability arises because user-supplied input is rendered into web pages without adequate output encoding or sanitization. An attacker with permission to create or modify folder metadata can embed JavaScript that persists in the database. When a victim loads a page rendering that data, the browser executes the injected script under the site's origin.

The scope-changed classification indicates the injected script crosses a trust boundary. Payloads placed by a low-privilege content contributor can execute in the session of a site administrator viewing the same content. The user interaction requirement is satisfied by normal browsing of affected admin or content pages.

Root Cause

The module fails to apply Drupal's standard output filters, such as Html::escape() or check_plain(), to attacker-controlled fields before rendering them in Twig templates or render arrays. Missing contextual encoding on folder names, descriptions, or related metadata allows HTML and script tags to reach the DOM intact.

Attack Vector

An authenticated user with permission to manage Media Folders submits crafted input containing script markup in a vulnerable field. The payload is stored in the Drupal database. When another user, typically an administrator, navigates to a page that renders the folder data, the browser parses and executes the script. The attacker can then exfiltrate session cookies, issue authenticated requests, or pivot to further compromise. Refer to the Drupal Security Advisory for module-specific technical details.

Detection Methods for CVE-2026-16638

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in Media Folders database tables
Outbound requests from administrator browsers to unfamiliar domains following Media Folders page loads
New or modified Drupal user accounts with elevated roles created shortly after folder edits
Anomalous session activity or admin actions originating from expected IP addresses but at unusual times

Detection Strategies

Audit Media Folders content in the database for HTML entities and script tokens using SQL queries against the media and taxonomy tables
Deploy Content Security Policy (CSP) reporting to surface inline script violations on admin pages
Correlate Drupal watchdog logs with web server access logs to identify who created or modified folders containing suspicious markup
Review browser telemetry from privileged users for script execution originating from the Drupal admin origin

Monitoring Recommendations

Enable and centralize Drupal dblog or syslog output to a SIEM for retention and correlation
Monitor HTTP responses from /admin/content/media and folder-listing routes for reflected untrusted input
Alert on additions to user_roles or permission changes shortly after Media Folders edits
Track file upload and media entity mutations performed by non-administrative accounts

How to Mitigate CVE-2026-16638

Immediate Actions Required

Upgrade the Media Folders module to a fixed release above 1.0.8 as published in the Drupal Security Advisory
Restrict Media Folders management permissions to trusted roles only until patching is complete
Audit existing folder entities and remove any content containing HTML or JavaScript markup
Invalidate active administrator sessions and rotate credentials if suspicious payloads are found

Patch Information

Drupal published fix guidance in advisory sa-contrib-2026-080. Site operators must update Media Folders to a version later than 1.0.8. Apply the module update using composer update drupal/media_folders followed by drush updatedb and cache rebuild. Verify the installed version with drush pm:list --type=module after deployment.

Workarounds

Disable the Media Folders module until an updated release can be deployed
Remove the administer media folders and equivalent permissions from non-trusted roles
Enforce a strict Content Security Policy that blocks inline scripts on Drupal admin routes
Place a web application firewall rule in front of Drupal to filter script tags submitted to media folder endpoints

bash

# Configuration example
composer update drupal/media_folders
drush updatedb -y
drush cache:rebuild
drush pm:list --type=module --status=enabled | grep media_folders