CVE-2026-0749
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Drupal's Form Builder module that allows attackers to inject malicious scripts into web pages. The vulnerability affects Drupal 7 installations using Form Builder module versions 7.x-1.0 through 7.x-1.22. Attackers can potentially steal user credentials, session cookies, or perform actions on behalf of authenticated users.
💻 Affected Systems
- Drupal Form Builder module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over the Drupal site, install backdoors, or pivot to internal systems if the Drupal instance has privileged access.
Likely Case
Attackers steal user session cookies or credentials, perform unauthorized actions on behalf of authenticated users, or deface website content.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, or if the vulnerable component is not exposed to untrusted users.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity. The advisory suggests the vulnerability requires user interaction but doesn't specify authentication requirements.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.x-1.23
Vendor Advisory: https://d7es.tag1.com/security-advisories/form-builder-less-critical-cross-site-scripting
Restart Required: No
Instructions:
1. Update the Form Builder module to version 7.x-1.23 or later. 2. Clear Drupal caches. 3. No server restart required.
🔧 Temporary Workarounds
Disable Form Builder module
linuxTemporarily disable the vulnerable module until patching is possible
drush pm-disable form_builder
Implement Content Security Policy
allAdd CSP headers to mitigate XSS impact
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or configure in Drupal's settings.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Disable the Form Builder module or restrict access to affected forms
🔍 How to Verify
Check if Vulnerable:
Check Form Builder module version: drush pmi form_builder | grep VersionCheck Version:
drush pmi form_builder | grep VersionVerify Fix Applied:
Verify module version is 7.x-1.23 or higher: drush pmi form_builder | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to form_builder endpoints
- JavaScript payloads in form submissions
- Multiple failed form submissions with script tags
Network Indicators:
- HTTP requests containing script tags or JavaScript payloads to form_builder paths
- Unusual outbound connections after form submissions
SIEM Query:
source="drupal_access.log" AND ("form_builder" AND ("<script" OR "javascript:" OR "onload=" OR "onerror="))