CVE-2025-48447: Drupal Lightgallery Cross-site Scripting Vulnerability
Summary
CVE-2025-48447: Drupal Lightgallery Cross-site Scripting vulnerability. Affects drupal/lightgallery versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Lightgallery is a popular package used for creating responsive image galleries in Drupal applications. It offers a range of features including customizable layouts, touch support, and various transition effects. However, it is susceptible to a Cross-site Scripting (XSS) vulnerability, which can compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by users. This can lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking. The issue affects versions of Lightgallery from 0.0.0 up to, but not including, 1.6.0. The severity of this vulnerability is classified as moderate, with a CVSS score of 6.3.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
composer require drupal/lightgallery:1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider sanitizing user inputs and escaping outputs to mitigate the risk of XSS attacks. This can be done by using Drupal's built-in functions such as check_plain() or htmlspecialchars() to ensure that any user-generated content is properly escaped before being rendered on the page.
Conclusion
The Drupal Lightgallery Cross-site Scripting vulnerability (CVE-2025-48447) poses a moderate risk to applications using versions prior to 1.6.0. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for drupal/lightgallery →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft or unauthorized actions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
If immediate updates are not possible, implement input sanitization and output escaping to reduce the risk of XSS attacks until you can upgrade to the patched version.
Exploitation of this vulnerability can lead to unauthorized actions on behalf of users, data theft, and session hijacking, compromising the integrity of your application.
Yes, Vulert provides automated monitoring for open-source vulnerabilities by analyzing your composer.lock file, allowing you to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/lightgallery.
