Description
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| drupal6 | drupal6 | 6.x before version 6.16, 5.x before version 5.22 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | drupal6 | 6.6-3lenny5 | DSA-2016-1 |
Advisories 1
- DSA-2016-1 drupal6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026