CVE-2026-84919: Drupal Photoswipe Module XSS Vulnerability
Summary
CVE-2026-84919: This module enables you to add dynamic caption support to PhotoSwipe image galleries. Affects drupal/photoswipe versions < 5.0.9. Fixed in 5.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Drupal Photoswipe module enhances image galleries by adding dynamic caption support. It allows users to create visually appealing galleries with captions that can be customized. However, the module has a critical vulnerability that arises from inadequate sanitization of user inputs, particularly in image alt tags, making it susceptible to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability stems from the Photoswipe module's failure to properly sanitize user-supplied inputs in its dynamic caption script. This oversight allows attackers to inject malicious scripts into the captions, which can then be executed in the browsers of users viewing the gallery. The potential ramifications include unauthorized access to user sessions, data theft, and the spread of malware. Importantly, an attacker must possess a role that allows them to enter HTML content to exploit this vulnerability.
How To Fix
Minimum fixed version
5.0.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user roles that have permission to enter HTML content until the module can be updated. This can help mitigate the risk of exploitation while you prepare to apply the patch.
Conclusion
The Drupal Photoswipe module has a critical XSS vulnerability due to inadequate input sanitization. It is essential to update to version 5.0.9 or later to protect against potential exploits. Additionally, consider implementing temporary restrictions on user roles to mitigate risks until the update can be applied.
See every vulnerability recorded for drupal/photoswipe →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue caused by insufficient sanitization of user inputs in the Photoswipe module.
An attacker must have a role that permits them to enter HTML content in order to exploit this vulnerability.
Exploitation can lead to unauthorized access to user sessions, data theft, and the potential spread of malware.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can temporarily restrict user roles that have permission to enter HTML content until the module is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/photoswipe.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
