Drupal Colorbox EUVD-2026-43073

Exploitation requires an authenticated account with at least low-level content creation or field-editing privileges on the target Drupal site (CVSS PR:L). The Colorbox module must be installed and enabled, and the attacker must have access to a content type or field that uses Colorbox rendering. A victim with a higher privilege level must subsequently view the page containing the injected payload (CVSS UI:R). Exploitation is limited to Drupal installations running Colorbox versions up to 2.1.5 or 2.2.0. Sites that restrict content creation exclusively to highly trusted roles significantly reduce real-world risk, as the PR:L requirement is the primary gating condition.

Real-world risk is moderate despite the medium CVSS score of 5.4. The scope change elevates practical impact - a low-privileged contributor (PR:L) could potentially hijack an administrator's session if the admin views the affected content. However, several signals temper urgency: EPSS at 0.20% (10th percentile) indicates very low current exploitation probability; the vulnerability is absent from the CISA KEV catalog; and no public exploit code has been identified at the time of analysis. The UI:R requirement means passive browsing is sufficient for a stored XSS victim to trigger execution - victims do not need to click a crafted link. The Drupal security team has published a patch, which meaningfully reduces the remediation window. This is a genuine but not emergency-tier finding: Drupal sites with untrusted content editors or public contribution features face higher risk and should prioritize patching.

An authenticated contributor-level user on a Drupal site - such as an editor or registered member - submits a Colorbox-formatted field value containing a crafted JavaScript payload. The Colorbox module renders this input unsanitized into the page HTML. When a site administrator or another authenticated user subsequently views the affected content, the malicious script executes in their browser session, potentially exfiltrating session cookies or performing actions on their behalf.