ByteOS Network

CVE Vulnerability Details :

CVE-2026-6367

PUBLISHED

More Info Official Page

Assigner-drupal

Assigner Org ID-2c85b837-eb8b-40ed-9d74-228c62987387

Published At-19 May, 2026 | 22:28

Updated At-19 May, 2026 | 22:28

▼CVE Numbering Authority (CNA)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

Affected Products

Vendor

The Drupal Association

Product

Drupal core

Collection URL

https://www.drupal.org/project/drupal

Repo

https://git.drupalcode.org/project/drupal

Default Status

unaffected

Versions

Affected

From 11.3.0 before 11.3.7 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Impacts

CAPEC ID	Description
CAPEC-63	CAPEC-63 Cross-Site Scripting (XSS)

CAPEC ID: CAPEC-63

Description: CAPEC-63 Cross-Site Scripting (XSS)

Credits

finder

cantina_security

finder

Dries Buytaert (dries)

finder

Shirsendu Mondal

remediation developer

Lee Rowlands (larowlan)

remediation developer

Drew Webber (mcdruid)

remediation developer

Mingsong (mingsong)

coordinator

Damien McKenna (damienmckenna)

coordinator

Greg Knaddison (greggles)

coordinator

Lee Rowlands (larowlan)

coordinator

Juraj Nemec (poker10)

coordinator

Jess (xjm)

References

Hyperlink	Resource
https://www.drupal.org/sa-core-2026-003	N/A

Hyperlink: https://www.drupal.org/sa-core-2026-003

Resource: N/A

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References