PT-2026-40837 · Drupal · Gtranslate

Edvard Ananyan + 3 · Published 2026-05-13 · Updated 2026-05-27 · CVE-2026-8492

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Translate Drupal with GTranslate versions 0.0.0 through 3.0.4

Description A Modification of Assumed-Immutable Data (MAID) issue in the GTranslate module allows Resource Location Spoofing. The module's widget JavaScript fails to sufficiently validate that document.currentScript refers to the executing script element. This allows a user capable of adding HTML to a page to cause the generated language-switcher links to point to an unintended domain. This issue is limited to sites using paid versions of the GTranslate widget JavaScript and configurations where generated language links use script-provided values. Exploitation requires the ability to add HTML with attributes not permitted by the default Drupal CKEditor configuration.

Recommendations Update to version 3.0.5.

Fix

Weakness Enumeration

CWE-471

Related Identifiers

CVE-2026-8492

DRUPAL-CONTRIB-2026-035

Affected Products

Gtranslate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8492 · Security Note
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-035 · Vendor Advisory
• https://t.me/cveNotify/164140 · Telegram Post
• https://drupal.org/sa-contrib-2026-035 · Note
• https://twitter.com/dailycve/status/2059687061490147445 · Twitter Post
• https://t.me/CVEtracker/54305 · Telegram Post