CVE-2025-48922

MEDIUM 6.1CVE-2025-48922 · DRUPAL-CONTRIB-2025-078 · Published 26/06/2025 · updated 17/06/2026

In short

CVE-2025-48922 is a MEDIUM (CVSS 6.1) vulnerability affecting drupal/glightbox, glightbox (levmyshkin).
Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 12.0% of all vulnerabilities.
Fix: update to 1.0.16 or later.

Package	Affected versions	Patched versions
drupal/glightbox Packagist:https://packages.drupal.org/8	`< 1.0.16`	`1.0.16`
glightbox levmyshkin	`< 1.0.16`	`1.0.16`

Description

GLightbox module is a pure Javascript lightbox for CKEditor.

The module doesn't sufficiently filter user-supplied text for the GLightbox Javascript library leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions to edit content that is configured to support the Glightbox module.

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

References

drupal.org/sa-contrib-2025-078 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free