Owl Carousel 2
CVE-2025-9554
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site using Owl Carousel 2
-
ExploitSend crafted unauthenticated request
-
ExecutionTrigger information disclosure
-
ImpactHarvest exposed data
Vulnerability Assessment
| Exploitation Conditions | The target must be a Drupal site with the 'Owl Carousel 2' contributed module installed and enabled; the advisory marks all versions ('*.*') as affected. The CVSS vector (AV:N/PR:N/UI:N) indicates no authentication or user interaction is required, so exposure is limited primarily by whether this specific module is deployed. The precise feature, endpoint, or configuration that triggers the disclosure is NOT stated in the available input and should be confirmed against SA-CONTRIB-2025-104; impact is confined to confidentiality (C:L) with no integrity or availability effect. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 5.3) in the Drupal 'Owl Carousel 2' contributed module, with signals that collectively point to LOW real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, but the only impact is limited confidentiality (C:L) with no integrity or availability effect - consistent with the 'Information Disclosure' tag. EPSS is low at 0.25% (15th percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided. The most significant limitation is the description itself, which is essentially empty ('Vulnerability in Drupal Owl Carousel 2... affects Owl Carousel 2: *.*') and names no mechanism, affected parameter, or data exposed - so the nature and sensitivity of the disclosed information cannot be verified from the input and must be confirmed against the Drupal security advisory SA-CONTRIB-2025-104. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to a Drupal site running the Owl Carousel 2 module and retrieves information that should not be exposed (scope limited to confidentiality per C:L). No public exploit code or proof-of-concept was identified at time of analysis, and the exact data exposed is not described in the available input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Information disclosure in the Drupal 'Owl Carousel 2' contributed module (all versions) allows unauthenticated remote attackers to access limited sensitive information, with impact confined to confidentiality (CVSS 5.3). No public exploit code has been identified, and the EPSS score is 0.25% (15th percentile), indicating low real-world exploitation likelihood. The module must be installed and enabled on a Drupal site for exposure, and the specific vulnerable feature or endpoint is not detailed in available data.
RemediationAI
Patch available per vendor advisory: review SA-CONTRIB-2025-104 (https://www.drupal.org/sa-contrib-2025-104) for the specific fixed version and update the Owl Carousel 2 module accordingly. Since all versions are marked as affected, any version not explicitly patched in the advisory should be considered vulnerable. If the module is not essential, disabling or uninstalling it eliminates the exposure, though this may impact site functionality (e.g., carousel displays). As a compensating control, consider monitoring for unusual access patterns, but note that the exact vulnerable endpoint is not detailed, limiting targeted network restrictions.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Owl Carousel 2 is a Drupal contributed module that integrates the Owl Carousel jQuery plugin, a responsive carousel slider, into Drupal sites. The vulnerability is an information disclosure issue, but no CWE is assigned, so the root cause class is not specified. The CPE 'cpe:2.3:a:owl_carousel_2_project:owl_carousel_2:*:*:*:*:*:drupal:*:*' confirms that all versions of the module are affected. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network exploitable, low complexity, no authentication or user interaction required, and only low confidentiality impact. The exact mechanism-whether an exposed endpoint, misconfigured access control, or other flaw-is not detailed in available data and should be confirmed via the vendor advisory SA-CONTRIB-2025-104.
Know when Owl Carousel 2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Tagged as unauthenticated network-reachable information disclosure (PR:N/UI:N/AV:N), low complexity, with only limited confidentiality impact and no integrity or availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB