CVE-2026-107265 in Leaflet
Summary
by MITRE • 10/30/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability represents a critical security flaw within the Drupal Leaflet module, specifically classified as an Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. This particular instance is categorized as Stored XSS, which distinguishes it from reflected variants by persisting malicious payloads on the target server rather than merely passing them through in a single request. The vulnerability affects all versions of the Leaflet module ranging from version 0.0.0 up to and including version 10.4.13, indicating that this is a long-standing issue present across multiple major releases if left unpatched.
From a technical perspective, the root cause lies in the insufficient sanitization or validation of user-supplied input before it is rendered within web pages generated by the module. When an attacker submits data containing executable JavaScript code through any interface provided by the Leaflet module that accepts such input without proper encoding, the application stores this malicious content in its backend database or persistent storage. Subsequently, when other users access a page where this stored data is displayed, their browsers execute the embedded script within the context of the vulnerable website. This mechanism allows the attacker to bypass same-origin policy restrictions and interact with the web application as if they were an authenticated user.
The operational impact of this Stored XSS vulnerability is severe due to its persistent nature. Unlike reflected XSS which requires tricking a specific victim into clicking a malicious link, stored XSS automatically affects every user who views the compromised content. Attackers can exploit this flaw to steal session cookies and authentication tokens, effectively hijacking user sessions and gaining unauthorized access to administrative accounts or sensitive user data. Furthermore, the vulnerability enables attackers to perform actions on behalf of victims, such as modifying site configurations, defacing web pages by injecting malicious HTML, or redirecting users to phishing sites designed to harvest credentials. In environments where Drupal is used for content management with multiple contributors, a single compromised input field can lead to widespread compromise across the entire platform.
This vulnerability maps directly to Common Weakness Enumeration identifier CWE-79, which covers Improper Neutralization of Script-Related HTML Tags in Web Pages, and aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for Command and Scripting Interpretation via JavaScript. The persistence aspect also correlates with the impact category of Data Exfiltration or Credential Access depending on the specific payload executed by the attacker.
To mitigate this risk, immediate action is required to update the Drupal Leaflet module to a version newer than 10.4.13 where these input validation issues have been addressed. Developers and site administrators should ensure that all third-party modules are kept up-to-date with security patches released by their maintainers. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded or executed, thereby limiting the impact even if a vulnerability is exploited. Input validation strategies should also be reviewed to ensure that all user inputs are strictly validated against expected formats and encoded appropriately before being rendered in HTML contexts, following the principle of least privilege for data handling within the application logic.