Drupal Umami Analytics CVE-2025-10931

Exploitation requires an attacker to already possess a high-privileged Drupal account (PR:H) with permission to configure the Umami Analytics module (versions 0.0.0 up to but not including 1.0.1). The malicious input must be injected through a module field/setting that is later rendered without output neutralization, so the payload affects other users who view the affected page. Limiting factors: the privileged-role prerequisite sharply narrows the attacker population to trusted/administrative users, there is no availability impact, and only the Umami Analytics contrib module on Drupal is affected. The precise configuration field is not named in the advisory description.

This is a low-severity issue (CVSS 3.8) that is unlikely to be an operational priority. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) is network-reachable with low complexity but requires high privileges (PR:H), meaning the attacker must already hold a privileged/administrative role in the Drupal site to inject the malicious payload - a significant limiting factor. EPSS is low at 0.20% (9th percentile), consistent with the low CVSS and the absence of any exploitation signal. There is no CISA KEV listing and no public POC identified, so there is no evidence of active or opportunistic exploitation. No SSVC decision data was provided in the input. The signals are mutually consistent (low CVSS, low EPSS, no KEV, no POC, high-privilege requirement all point the same direction); there is no conflict to flag. The only real-world risk is a malicious or compromised privileged user staging stored XSS against other users of the site, so this is best treated as a routine patch-when-convenient item rather than an emergency.

A user who already holds a high-privileged role (e.g., a site administrator or content/configuration manager) that can configure the Umami Analytics module supplies a crafted value containing a script payload. When another user loads a page where that value is rendered without proper neutralization, the injected JavaScript executes in the victim's browser. No public exploit code was identified for this issue.