Drupal Data Field EUVD-2026-113522

Exploitation requires an authenticated account with permission to store/edit content in a Drupal Data field module (versions 0.0.0 through 2.0.14), plus a second user who subsequently views the page rendering that field (UI:R). The vendor rates the required privilege as high (PR:H), meaning a trusted/elevated role is needed to plant the payload rather than an anonymous visitor. These two factors - privileged write access and required victim interaction - substantially limit realistic exploitation; it is not remotely exploitable against default, unauthenticated configurations. Note the Data field module is a Drupal contrib extension, not Drupal core, so only sites that have installed and enabled it are affected.

This is a low-severity stored XSS (CVSS 3.5) that signals do NOT elevate to a priority issue. The vendor CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) already encodes meaningful friction: the PR:H component means the attacker must already hold high privileges to inject the payload, and UI:R means a victim must then view the malicious content. EPSS reinforces low real-world risk at 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced - all three signals point the same direction with no conflict. The vuln.today decision label is 'monitor,' consistent with the low-urgency picture. One tension worth noting: the vendor assigned PR:H, but many Drupal contrib stored-XSS issues are triggerable by any authenticated user permitted to submit field content (PR:L); the Drupal advisory (sa-contrib-2026-250) was not available for this analysis, so the exact privilege required is not independently confirmed. Overall this is a genuinely low-risk, high-privilege, user-interaction-gated flaw rather than a widespread-exploitation threat.

A user with sufficient privileges to populate a Data field stores a malicious script payload instead of benign data. When another user - typically an administrator or editor - later views the page that renders this field, the script executes in their authenticated browser session, potentially enabling session actions or content manipulation. No public exploit is identified at time of analysis, and exploitation requires both privileged write access and victim interaction.