CVE-2026-84919 in PhotoSwipe Plugin
Summary
by MITRE • 10/22/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Drupal module known as PhotoSwipe, specifically in its implementation of a responsive JavaScript modal image gallery functionality. This vulnerability is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation, commonly referred to as Cross-Site Scripting or XSS. The specific manifestation of this issue allows for Stored XSS attacks, meaning that malicious scripts are permanently stored on the target server within the application's database or content storage mechanisms rather than being transmitted via a single request and discarded immediately after execution by the victim's browser. This distinction significantly elevates the severity of the vulnerability compared to reflected variants, as the payload persists and affects every user who views the compromised content without requiring further interaction from the attacker beyond the initial injection.
The technical root cause lies in the insufficient validation and sanitization of user-supplied input before it is rendered within the HTML context by the PhotoSwipe module's JavaScript components or associated Drupal rendering pipelines. When an authenticated user, such as a site administrator or contributor with permission to upload media or create content containing gallery references, submits data that includes malicious script fragments, the application fails to properly escape special characters or strip executable code. Consequently, when other users access pages displaying these images or galleries, their browsers interpret and execute the injected scripts in the context of the vulnerable website's domain. This environment allows the attacker to bypass same-origin policy restrictions, granting them the ability to interact with the DOM as if they were a legitimate user of the application.
The operational impact of this Stored XSS vulnerability is substantial, particularly for Drupal-based websites that rely on community contributions or multi-user content management workflows. An attacker can exploit this flaw to steal session cookies and authentication tokens, thereby hijacking active sessions of other users including administrators. This leads to unauthorized access to sensitive areas of the website, potential defacement, and the ability to perform actions on behalf of victims such as changing passwords, modifying site configurations, or injecting further malware. Furthermore, attackers can use this vector for phishing attacks by redirecting users to malicious sites that mimic legitimate login pages, thereby harvesting credentials from unsuspecting visitors. The persistence of the payload ensures a prolonged period of risk until the malicious content is manually identified and removed from the database, which may be difficult if the attacker has obscured the script using encoding techniques or obfuscation methods.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary and most effective solution is to upgrade the PhotoSwipe module to version 5.0.10 or later, where this input validation flaw has been addressed by developers through enhanced sanitization routines. For sites unable to update immediately due to compatibility constraints, temporary mitigations include implementing a Web Application Firewall (WAF) with rules specifically tuned to detect and block XSS payloads in HTTP requests related to media uploads and content creation. Additionally, administrators should enforce strict Content Security Policy headers that restrict the execution of inline scripts where possible, although this must be carefully configured to avoid breaking legitimate functionality within the Drupal ecosystem. Regular security audits and code reviews focusing on input handling for all user-facing modules are essential to prevent similar vulnerabilities from being introduced in future updates or custom integrations.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Client-Side Injection, specifically T1059 which covers command and script interpretation through browser-based execution. The stored nature of the attack facilitates lateral movement within the application's user base once initial access is gained via social engineering or direct submission by a compromised account. Security teams should monitor logs for unusual patterns in media upload endpoints and review recent content submissions for anomalous HTML structures that may indicate successful exploitation attempts prior to patching. Maintaining an inventory of all third-party modules and ensuring they are kept up-to-date with security releases is critical, as legacy versions like those ranging from 0.0.0 to 5.0.9 represent known attack surfaces that are actively targeted by automated scanning tools and exploit kits distributed across the dark web ecosystem.