CVE-2026-107265 drupal CVE debrief

Who should care

Defenders responsible for maintaining Drupal installations with the Leaflet module should assess exposure and prioritize updates or mitigations. They need to verify and update the Leaflet module to prevent potential XSS attacks. Sites with user-generated content using Leaflet maps may be vulnerable to stored XSS. Required permissions mitigate the vulnerability but also limit exploitation.

Why it matters

A stored cross-site scripting vulnerability in the Leaflet module for Drupal requires defenders to verify and update the module, restrict permissions, and monitor user-generated content.

• Defenders need to verify and update the Leaflet module to prevent potential XSS attacks
• Sites with user-generated content using Leaflet maps may be vulnerable to stored XSS
• Required permissions mitigate the vulnerability but also limit exploitation

Technical summary

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map, it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map. The vulnerability requires defenders to verify and update the module, restrict permissions, and monitor user-generated content. The Leaflet module does not filter content titles when building a map, leading to a stored cross-site scripting vulnerability.

Defensive priority

Defenders should prioritize verifying and updating the Leaflet module to the latest version, especially if the module is used in conjunction with user-generated content.

Recommended defensive actions

• Verify the Leaflet module version and update to the latest version if necessary
• Restrict permissions to create or edit content used in Leaflet maps
• Monitor user-generated content for potential XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the Drupal security team and is tracked as DRUPAL-CONTRIB-2026-204. The Leaflet module does not filter content titles when building a map, leading to a stored cross-site scripting vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.