CVE-2026-13231: Drupal Admin Feedback Module Insufficient Input Sanitization Vulnerability
Summary
CVE-2026-13231: This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. Affects drupal/admin_feedback versions < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Admin Feedback module allows site administrators to collect feedback from visitors on content pages through Yes/No buttons. It provides a dashboard for reviewing responses, making it a useful tool for enhancing user engagement. However, this module has a critical vulnerability that arises from its failure to properly sanitize administrator-configured response messages, which can lead to security risks if HTML or script markup is included.
Vulnerability Detail
The vulnerability stems from the module's inadequate sanitization of several response messages configured by administrators, specifically the 'Yes response', 'No response', and custom text for 'No' answers. When these settings contain HTML or script markup, the module emits this content as raw HTML in the feedback response shown to visitors. This can lead to Cross-Site Scripting (XSS) attacks, where an attacker could execute malicious scripts in the context of the user's browser. The risk is heightened as an attacker must possess a role with the permission 'administer admin feedback' to exploit this vulnerability.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can avoid using HTML or script markup in the response messages until the module is updated. This will help mitigate the risk of XSS attacks while waiting for a permanent fix.
Conclusion
The CVE-2026-13231 vulnerability in the Drupal Admin Feedback module highlights the importance of proper input sanitization in web applications. By updating to the patched version and following best practices, site administrators can protect their users from potential security threats.
See every vulnerability recorded for drupal/admin_feedback →
FAQ
The vulnerability is related to insufficient input sanitization of administrator-configured response messages, which can lead to XSS attacks.
If you are using a version of the Admin Feedback module prior to 2.8.0, your site is potentially vulnerable. You can check your module version in the Drupal admin interface.
As a temporary measure, refrain from using HTML or script markup in the response messages to reduce the risk of exploitation.
An attacker must have a role with the permission 'administer admin feedback' to exploit this vulnerability, making it less likely for general users to be affected.
You can find detailed information about this vulnerability on the Drupal Security Team's advisory database and other security-focused platforms.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/admin_feedback.
