CVE-2026-55805: Drupal Core Stored XSS Vulnerability

CVE-2026-55805 Overview

CVE-2026-55805 is a stored cross-site scripting (XSS) vulnerability in Drupal core. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject persistent scripts that execute in other users' browsers when they view affected pages.

The issue affects Drupal core versions from 0.0.0 to 10.6.13, 11.3.0 to 11.3.14, 11.4.0 to 11.4.4, and all 11.0.x, 11.1.x, and 11.2.x releases. The scope change in the CVSS vector indicates impact extends beyond the vulnerable component to other browser contexts.

Critical Impact
Stored XSS enables session theft, credential harvesting, and unauthorized actions performed under the identity of any user who views the injected content, including administrators.

Affected Products

Drupal core versions 0.0.0 through 10.6.13
Drupal core versions 11.0.x, 11.1.x, 11.2.x (all releases)
Drupal core versions 11.3.0 through 11.3.14 and 11.4.0 through 11.4.4

Discovery Timeline

2026-08-25 - CVE-2026-55805 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55805

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in Drupal core. Attacker-supplied input is written to persistent storage and later rendered without sufficient encoding or sanitization. When another user loads a page that includes the injected content, the browser executes the attacker's script in the context of the Drupal site.

Stored XSS in a content management system carries elevated impact. Injected payloads persist across sessions and can target every user who visits an affected page. Because Drupal delegates significant authority to authenticated editors and administrators, script execution in their browsers can lead to takeover of privileged accounts.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. A code path in Drupal core renders user-controlled data without escaping HTML metacharacters or stripping active script content. The specific field or subsystem is not disclosed in the public advisory metadata.

Attack Vector

Exploitation requires network access to the Drupal application and low-privilege authenticated access to submit the malicious payload. A victim user must then view the page containing the stored payload for the script to execute. The attacker does not need administrative rights to plant the payload but benefits when higher-privileged users load it.

Refer to the Drupal Security Advisory SA-CORE-2026-012 for vendor-supplied technical details.

Detection Methods for CVE-2026-55805

Indicators of Compromise

Stored content fields containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URIs where plain text is expected.
Outbound requests from authenticated user browsers to unfamiliar domains shortly after visiting Drupal pages.
Unexpected administrative actions or new user accounts created shortly after admin sessions on affected pages.

Detection Strategies

Review Drupal database tables for entity fields, comments, and node revisions containing script tags or event handler attributes.
Correlate web server access logs with POST requests to content creation endpoints followed by admin session activity.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts.

Monitoring Recommendations

Monitor Drupal watchdog logs for anomalous editorial activity from low-privilege accounts.
Alert on browser telemetry that shows script execution referencing external hosts from within admin routes such as /admin/*.
Track file uploads and content submissions containing HTML payloads submitted by non-administrator roles.

How to Mitigate CVE-2026-55805

Immediate Actions Required

Upgrade Drupal core to a patched release above 10.6.13, 11.3.14, or 11.4.4 as identified in SA-CORE-2026-012.
Audit content submitted by low-privilege authenticated users since the earliest suspected exposure date.
Rotate session tokens and administrative credentials if evidence of exploitation is found.

Patch Information

Drupal has published fixed releases in the Drupal Security Advisory SA-CORE-2026-012. Apply the vendor-supplied update using composer update drupal/core --with-all-dependencies and run database updates through drush updatedb or /update.php.

Workarounds

Restrict content submission privileges to trusted user roles until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script origins.
Place a web application firewall rule in front of Drupal that blocks HTML tags in fields expected to be plain text.

bash

# Update Drupal core to the patched release
composer update drupal/core drupal/core-recommended drupal/core-composer-scaffold --with-all-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild