What is the CVSS score of CVE-2026-58591?

CVE-2026-58591 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-58591?

Yes, a patch is available for CVE-2026-58591. Update the affected software to the latest version immediately.

Drupal Colorbox CVE-2026-58591

EUVD-2026-43073 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 drupal

GHSA-xj92-p35c-g452

XSS Drupal Colorbox

5.4

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by authenticated contributor requirement; S:C reflects XSS crossing into victim browser context; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 19:51 vuln.today

CVSS changed

Jul 13, 2026 - 19:22 NVD

5.4 (MEDIUM)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:46 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

AnalysisAI

Cross-site scripting in the Drupal Colorbox module allows an authenticated low-privileged attacker to inject malicious scripts that execute in the browser context of other users. The CVSS scope-change indicator (S:C) confirms this is likely stored XSS, where crafted input persists and executes when victims visit affected pages. No active exploitation is confirmed - EPSS sits at 0.20% (10th percentile) and the vulnerability is not listed in the CISA KEV catalog - but a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-069.

Technical ContextAI

Colorbox is a Drupal contributed module (cpe:2.3:a:drupal:colorbox:*:*:*:*:*:*:*:*) that integrates the jQuery Colorbox lightbox plugin for displaying images, HTML, and multimedia in overlay dialogs. The root cause is CWE-79 - Improper Neutralization of Input During Web Page Generation - meaning user-supplied content is rendered into the HTML output without adequate escaping or sanitization. The CVSS scope-change metric (S:C) indicates the payload crosses a security boundary: script injected by a low-privileged author executes within the browser session of a different, potentially more privileged, user. This is a classic stored XSS pattern common in CMS content management modules where content editors can supply Colorbox-formatted field values.

RemediationAI

Apply the vendor-released patch by upgrading the Drupal Colorbox module to the fixed version per Drupal security advisory SA-CONTRIB-2026-069 (https://www.drupal.org/sa-contrib-2026-069). For sites on the 2.1.x branch, upgrade beyond 2.1.5; for sites on the 2.2.x branch, upgrade beyond 2.2.0. An exact patched release version was not independently confirmed from the available input data - consult the advisory directly for the precise target version. If an immediate upgrade is not possible, restrict the 'create content' or field-editing permissions for the affected Colorbox-configured content types to trusted roles only, which reduces the PR:L attack surface by preventing untrusted contributors from injecting payloads. Note that this workaround does not eliminate the vulnerability if any contributor-level role exists with field access.