Drupal Media Folders CVE-2026-16638

Exploitation requires that the target Drupal installation has the Media Folders contributed module installed and enabled in a version from 0.0.0 up to (but not including) 1.0.8 - this is a non-core, opted-in module and not present by default. The attacker must have permission to create or modify media folder entries; the CVSS PR:N rating suggests the injection point may be reachable without authentication, but this is not confirmed by the description - the exact permission level required is unspecified in available data. A victim user must subsequently navigate to the affected media folder page (UI:R), meaning passive or automated exploitation without victim interaction is not possible. Limiting exploitation: the module must be actively installed and non-default; user interaction is mandatory; and impact is bounded to low confidentiality and integrity with no availability impact (C:L/I:L/A:N).

The CVSS 6.1 score with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately captures the network-accessible, low-complexity nature of the flaw while bounding impact to low confidentiality and integrity. The EPSS probability of 0.15% at the 4th percentile is very low, consistent with the SSVC assessment of 'exploitation: none' and 'automatable: no' - indicating no observed mass exploitation and no straightforward automated attack path. The CVE is absent from CISA KEV and no POC has been identified, placing this firmly in the category of unconfirmed-exploitation risk. The stored nature of the XSS is the primary risk amplifier: a single successful injection can silently affect every authenticated user who browses media folders, including site administrators whose session tokens could enable full site takeover - a meaningful tail risk even at low EPSS. SSVC's 'technical impact: partial' and the low C:L/I:L CVSS impact metrics are consistent. Overall this is a genuine vulnerability warranting patching in a standard change cycle, but the convergent signals from EPSS, KEV absence, SSVC, and non-automatable classification do not support emergency response prioritization.

An attacker with permission to create or rename media folders submits a folder name containing a JavaScript payload such as a script tag or event-handler attribute that Drupal Media Folders fails to sanitize before storage. When an authenticated site administrator subsequently visits the Media Folders management page, the stored payload executes in the admin's browser, silently exfiltrating their session cookie to an attacker-controlled endpoint and granting the attacker full administrative access. No public exploit code has been identified at time of analysis.