{"id":"CVE-2026-6367","published":"2026-05-19T22:28:07Z","modified":"2026-06-22T15:07:43Z","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).\n\nThis issue affects Drupal core: from 11.3.0 before 11.3.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00201,"percentile":0.09989,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-003","tags":[]}],"priority":{"score":6.3,"factors":[{"name":"EPSS percentile","points":2.0},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 11.3.0, < 11.3.7"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=11.3.0, <11.3.7"],"patched":["11.3.7"],"from":["GHSA-pw6f-3999-xp7g","DRUPAL-CORE-2026-003"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-31002","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-13083","published":"2025-11-18","fixed":"11.2.8","kev":false},{"cve":"CVE-2026-6365","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-6366","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-6367","published":"2026-05-19","fixed":"11.3.7","kev":false},{"cve":"CVE-2026-9082","published":"2026-05-20","fixed":"11.3.10","kev":true,"link":{"from":"CVE-2026-6367","to":"CVE-2026-9082","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.3.7","toFixed":"11.3.10","daysApart":1}]}},{"cve":"CVE-2026-55803","published":"2026-07-10","fixed":"11.3.12","kev":false},{"cve":"CVE-2026-55804","published":"2026-07-10","fixed":"11.3.12","kev":false}],"package":"Packagist:drupal/core"}}