CVE-2026-76782: Drupal Screenshot XSS Vulnerability

CVE-2026-76782 Overview

CVE-2026-76782 is a cross-site scripting (XSS) vulnerability affecting the Drupal Screenshot contributed module. The flaw is classified under [CWE-79], improper neutralization of input during web page generation. An attacker who successfully exploits this issue can inject script content that executes in the browser of a victim who interacts with the affected page. The vulnerability carries a scope change, meaning impact extends beyond the vulnerable component to other resources under the same origin. Successful exploitation requires user interaction and elevated privileges on the target site, which raises attack complexity.

Critical Impact
Successful exploitation allows script injection in the context of an authenticated Drupal session, enabling session compromise, defacement, and unauthorized actions across the affected site.

Affected Products

Drupal Screenshot module (contributed module)
Drupal sites with the Screenshot module installed and enabled
All Screenshot module versions covered by advisory SA-2026-102

Discovery Timeline

2026-09-02 - CVE-2026-76782 published to NVD
2026-09-02 - Last updated in NVD database
Reference - Drupal Security Advisory SA-2026-102

Technical Details for CVE-2026-76782

Vulnerability Analysis

The Drupal Screenshot module fails to properly neutralize user-controllable input before rendering it in generated web pages. This condition maps to [CWE-79], the standard weakness class for reflected, stored, or DOM-based cross-site scripting. When an authenticated user with sufficient privileges submits crafted content, the module renders that content into HTML without adequate encoding or sanitization. A victim who then views or interacts with the affected page executes attacker-supplied JavaScript within the site origin.

The scope-changed impact indicates that injected script can influence resources outside the immediate vulnerable component. In a Drupal deployment this typically translates to the ability to act as the victim across the wider CMS, including administrative interfaces reachable within the same session. Attacker capabilities include reading session tokens, submitting forms on behalf of the victim, exfiltrating page content, and pivoting to further privileged actions where the victim holds elevated roles.

Root Cause

The root cause is missing or incomplete output encoding in the Screenshot module's rendering path. Drupal provides sanitization primitives such as Xss::filter(), Html::escape(), and the Twig auto-escaping engine, but the vulnerable code path does not consistently apply them to attacker-controlled fields before they reach the response body.

Attack Vector

The attack vector is network-based but requires an authenticated actor with high privileges to plant the payload, plus user interaction from a second victim to trigger execution. A privileged content contributor stores crafted markup through the module. When another user, often an administrator, loads the affected view, the browser parses and executes the payload under the Drupal site's origin.

No verified public exploit code is available at time of publication. Refer to the Drupal Security Advisory SA-2026-102 for vendor technical details.

Detection Methods for CVE-2026-76782

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: fragments stored in Screenshot module fields or associated database tables
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading Screenshot-related pages
New or modified Drupal user accounts with elevated roles created after an administrator viewed affected content
Session cookies observed in web server logs being replayed from unexpected IP addresses

Detection Strategies

Review Drupal watchdog and access logs for requests to Screenshot module routes containing HTML-encoded script markers or unusual query parameters
Deploy web application firewall rules that flag payloads containing script tags and event handler attributes submitted to module endpoints
Run database queries against Screenshot-related tables to identify stored values matching common XSS payload patterns

Monitoring Recommendations

Forward Drupal application logs, web server access logs, and WAF telemetry to a centralized analytics platform for correlation
Alert on privilege changes, role assignments, and administrative configuration edits that follow rendering of Screenshot module content
Track Content Security Policy violation reports to surface script execution attempts blocked by browser policy

How to Mitigate CVE-2026-76782

Immediate Actions Required

Apply the fixed release of the Drupal Screenshot module as directed by Drupal Security Advisory SA-2026-102
Audit users assigned roles that can submit content through the Screenshot module and revoke unnecessary privileges
Invalidate active administrator sessions and rotate credentials for accounts that may have viewed attacker-controlled content
Review Screenshot module content for stored payloads and remove any injected markup before restoring normal operations

Patch Information

Refer to Drupal Security Advisory SA-2026-102 for the fixed module version and upgrade instructions. Drupal contributed module patches are distributed through the project's release page and can be applied using composer update or the standard Drupal module update workflow.

Workarounds

Disable the Screenshot module until the patched version is deployed if the module is not business-critical
Restrict roles and permissions so that only fully trusted accounts can submit content processed by the module
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources to reduce XSS impact
Deploy WAF signatures that inspect and block script tags and event handler attributes on module submission endpoints

bash

# Example: update the Screenshot module via Composer and clear caches
composer update drupal/screenshot --with-dependencies
drush updatedb
drush cache:rebuild