Drupal Colorbox Inline EUVD-2026-30990

Exploitation requires an authenticated session with low-level privileges on the Drupal site (confirmed by CVSS PR:L); unauthenticated exploitation is not possible. The attacker must have sufficient Drupal permissions to submit or edit content processed by the Colorbox Inline module - this is a non-default configuration concern, as not all authenticated users will have this capability by default. A separate victim with a browser session must then interact with (load or preview) the page containing the injected payload (CVSS UI:R); the attacker cannot trigger execution autonomously. Exploitation is further limited to Drupal sites running Colorbox Inline versions 0.0.0 through 2.1.0 - sites on 2.1.1 or later are not affected.

The overall risk profile is moderate-low despite a CVSS base score of 5.4. The CVSS vector PR:L confirms that exploitation requires an authenticated session with at least low-level privileges - anonymous exploitation is not possible. UI:R introduces a dependency on victim interaction, meaning the attacker cannot trigger execution unilaterally. The EPSS score of 0.03% at the 8th percentile strongly suggests negligible real-world exploitation interest at this time, and the absence of a CISA KEV listing corroborates that no confirmed active exploitation has been observed. There is no publicly available exploit code (POC) identified in the provided data. The S:C (changed scope) element is consistent with XSS impact but does not elevate practical severity given the PR:L prerequisite. Overall, this vulnerability is a genuine security issue in environments where untrusted users with edit permissions interact with Colorbox Inline content, but it is not a high-urgency emergency - organizations should patch on their next maintenance cycle rather than treating it as a critical incident.

An attacker with a low-privileged Drupal account (such as an authenticated content editor or contributor) crafts a malicious payload containing JavaScript and submits it through the Colorbox Inline module's input fields. When a higher-privileged user - such as an administrator - visits or previews the affected page, their browser executes the injected script in the context of the Drupal site, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public POC exists, so exploitation currently requires manual crafting of the payload.