Drupal Core EUVD-2026-66183

Exploitation requires two conditions to align: first, an attacker must hold a low-privileged authenticated account on the target Drupal site with permission to create or edit content (e.g., contributor, editor, or any role with node/comment create permissions) - sites with open user registration are more exposed. Second, a separate victim user must browse to the page where the malicious payload was stored; the attack does not self-propagate. Sites where content creation is restricted to highly trusted roles, or where anonymous registration is disabled and role assignment is tightly controlled, face materially reduced risk. The CVSS UI:R constraint limits automatable mass exploitation, per SSVC Automatable: no.

The CVSS 3.1 score of 5.4 (Medium) reflects genuine constraints: PR:L requires an authenticated low-privileged user to submit the payload, and UI:R means a second user must browse the affected content before the payload fires - ruling out automated mass exploitation. These constraints are corroborated by CISA SSVC (Automatable: no, Technical Impact: partial) and the EPSS score of 0.15% (4th percentile), indicating this CVE is among the lower-risk tier for imminent exploitation in the wild. KEV status is absent and no POC has been reported. The S:C scope change elevates concern for privileged-user hijacking - an attacker planting a payload could steal an administrator's session cookie, effectively escalating to full site compromise - but this requires the admin to view the malicious content. Real-world risk is elevated for publicly accessible Drupal sites where anonymous or low-privilege registration is open, and lower for tightly access-controlled deployments. The 11.0.*, 11.1.*, and 11.2.* branches appear to be fully affected with no patched release in those trains, suggesting end-of-life status; operators on those branches have no in-branch fix path.

An attacker registers or obtains a low-privileged account on a Drupal site (e.g., an authenticated contributor role), then submits a node, comment, or other content containing a crafted XSS payload that bypasses Drupal's input filters. When an administrator or other user later browses the affected content page, their browser executes the injected script - potentially exfiltrating the admin's session cookie, redirecting to a phishing page, or silently performing authenticated actions on their behalf. No public exploit code has been identified at time of analysis.