Vulnerability Directory | CVE-2025-3900 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

The Colorbox module presents images, iframed or inline content to be displayed in a modal above the current page.

Because the Colorbox module doesn't sufficiently sanitize data attributes before opening modals, it’s possible for a malicious actor to include links that give further access to the website. The vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

Session hijacking
Data theft
Malware distribution
Defacement or phishing, and
Privilege escalation.

This issue affects all versions of Drupal 7 Colorbox equal to or lower than 7.2.19 and is patched in Colorbox NES version 7.2.20.

‍

Details

Module Info

Product: Drupal
Affected code: Colorbox module
Affected versions: <=7.2.19
Project page: https://drupal.org/project/colorbox
Fixed in: Colorbox NES 7.2.20

‍

Vulnerability Info

This medium-severity vulnerability is found in all versions of the Colorbox module equal to or lower than 7.2.19.

Without complete sanitization, several variations of XSS exploits are possible:

data-cbox-title attribute

<a class="colorbox" data-cbox-title="<img src=x onerror=alert()>" href="https://example.com">test</a>

javascript: protocol in data-cbox-href attribute

<a class="colorbox" data-cbox-href="javascript:alert()" href="https://example.com">test</a>

non-http/https protocols in href attribute
<a class="colorbox" href="javascript:alert()">test</a> (or data:, vbscript:, etc.)
data-cbox-iframe-attrs attribute
other colorbox data attributes such as data-cbox-next, data-cbox-previous, data-cbox-current, data-cbox-close, data-cbox-slideshowstop, data-cbox-slideshowstart, data-cbox-xhr-error, data-cbox-imgerror, data-cbox-html.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

Remove "Full HTML" format access from untrusted users.
Disable the module.
For defense-in-depth, enable strict Content Security Policy (CSP) Headers.
Disable Javascript for Colorbox links (which prevents Colorbox from working at all).
However, the above may not deter determined attackers and have trade-offs. Consider signing up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.