CVE-2026-16638

Drupal Media Folders versions 0.0.0 to 1.0.8 are vulnerable to a stored cross-site scripting (XSS) flaw due to improper input neutralization during web page generation. This vulnerability could allow attackers to inject malicious scripts that execute in the context of users' browsers, potentially compromising user data and session integrity. Organizations using affected versions of Drupal Media Folders should prioritize remediation to safeguard against potential exploitation.