{"id":"CVE-2026-84919","kind":"vulnerability","aliases":["CVE-2026-84919"],"related":[],"title":"Drupal PhotoSwipe gallery module: stored XSS through unsanitized input","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.","summary":"The Drupal PhotoSwipe responsive image gallery module fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content that the gallery renders can run JavaScript in other visitors' browsers.","severity":"medium","cvss":4.6,"epss":0.00162,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","package","php"],"not_affected_if":["module-not-installed","trusted-content-only"],"how_to_check":"- Check the installed PhotoSwipe module version with `drush pm:list --filter=photoswipe` or in the Drupal admin under Extend\n- Confirm whether the module is enabled on the site","fix":"- Upgrade the Drupal PhotoSwipe module to a version later than `5.0.9`\n- Until upgraded, restrict who can enter content into gallery fields","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:30+00:00","updated_at":"2026-10-25T04:35:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal PhotoSwipe module to a version later than `5.0.9`\n- Until upgraded, restrict who can enter content into gallery fields","reach":"internet","title":"Drupal PhotoSwipe gallery module: stored XSS through unsanitized input","impact":"medium","summary":"The Drupal PhotoSwipe responsive image gallery module fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content that the gallery renders can run JavaScript in other visitors' browsers.","category":"package","nicknames":[],"who_cares":["drupal","php","cms"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers, stealing sessions","analyst_note":"","how_to_check":"- Check the installed PhotoSwipe module version with `drush pm:list --filter=photoswipe` or in the Drupal admin under Extend\n- Confirm whether the module is enabled on the site","needs_analyst":false,"not_affected_if":["module-not-installed","trusted-content-only"],"who_is_affected":"Drupal sites running the PhotoSwipe module at version `5.0.9` or earlier, where gallery output shows content entered by users with lower trust. Sites without the module installed, or that only show gallery content entered by trusted editors, face less risk. Hosted sites that do not run Drupal can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3390,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-84919':12A,15A '0.0.0':93C '5.0.9':95C 'affect':84C 'allow':79C 'attack':42B 'browser':57B 'cms':16B 'content':46B 'cross':38B,67C 'cross-sit':37B,66C 'cve':10A,13A 'drupal':1A,17B,21B,72C 'enabl':35B 'fail':27B 'galleri':3A,25B,49B,78C,90C 'generat':32B,65C 'imag':24B,77C,89C 'improp':58C 'input':9A,30B,61C 'issu':83C 'javascript':53B,75C,87C 'modal':76C,88C 'modul':4A,26B 'neutral':29B,59C 'packag':18B 'page':34B,64C 'photoswip':2A,22B,73C,85C 'php':19B 'render':50B 'respons':23B,74C,86C 'run':52B 'script':40B,69C 'site':39B,68C 'store':5A,36B,45B,80C 'unsanit':8A 'version':91C 'visitor':56B 'vulner':70C 'web':33B,63C 'xss':6A,81C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the PhotoSwipe module at version `5.0.9` or earlier, where gallery output shows content entered by users with lower trust. Sites without the module installed, or that only show gallery content entered by trusted editors, face less risk. Hosted sites that do not run Drupal can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84919","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84919","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84919","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}