Project:
Date:
2026-July-22
Vulnerability:
Cross site scripting
Affected versions:
<1.0.8
CVE IDs:
CVE-2026-16638
Description:
This module provides a better UI for managing and selecting Media entities in a folder structure.
The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.
Solution:
Install the latest version:
- If you use the Media Folders module, upgrade to Media Folder 1.0.8
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
Coordinated By:
- Juraj Nemec (poker10) of the Drupal Security Team
