Project
Colorbox
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability
Cross Site Scripting
Affected versions
<7.x-2.20

Description

The Colorbox module allows images, iframed, or inline content to be displayed in a modal above the current page.

The Colorbox module doesn't sufficiently sanitize data attributes before opening modals.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.

This is a backport of https://www.drupal.org/sa-contrib-2025-041.

Solution

Install the latest version.

If you use the Colorbox module for Drupal 7, upgrade to Colorbox 7.x-2.20

Reported By: 

Fixed By: 

Coordinated By: