Vulnerability Directory | CVE-2025-14556 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications. The Flag module allows an infinite number of flags to be added to nodes in the system, such as for bookmarks, friends, etc.

Originally found in Backdrop, this exploit was also found in versions of the Flag module used by Drupal 7.

There were two aspects to the vulnerability. The first was that the module didn't verify flag links before performing flag actions and the second was that the module didn't verify that responses were actually from the Flag module. Thus, attackers with permission to create links (e.g., in comments or content) could craft malicious HTML to execute XSS attacks.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

Session hijacking
Data theft
Malware distribution
Defacement or phishing, and
Privilege escalation.

This issue affects all versions of Drupal 7 Flag equal to or lower than 7.1.9 and is patched in Flag NES version 7.1.10.

‍

Details

Module Info

Product: Drupal
Affected code: Flag module
Affected versions: <=7.3.9
Project page: https://www.drupal.org/project/flag
Fixed in: Flag NES 7.3.10

‍

Vulnerability Info

This medium-severity vulnerability is found in all versions of the Flag module equal to or lower than 7.3.9.

The exploit spans both the Javascript code and the PHP code in the module. The Javscript did not perform proper validation (including ensuring provided links were for local targets only and other checks). The PHP code did not verify that responses came from the Flag module itself (rather than a malicious external source), so the patch added token echo-back functionality that allows the JavaScript to confirm the response is legitimate.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

Change all flags to use "Normal link" instead of "JavaScript toggle" link type.
Remove "Full HTML" format access from untrusted users.
Configure comment text formats to strip all HTML.
However, the above may not deter determined attackers and have trade-offs. Consider signing up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍