PT-2026-63534 · Packagist · Drupal/Media Folders
CVE-2026-16638
·
Published
2026-07-22
·
Updated
2026-07-22
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
This module provides a better UI for managing and selecting Media entities in a folder structure.
The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Media Folders