CVE-2026-16638 is a stored XSS vulnerability in the Drupal media_folders module that arises from inadequate sanitization of names and descriptions of media items and folders in the media browser UI. This allows an attacker with appropriate media creation or editing permissions to inject malicious scripts that persist in the system and execute when viewed by users with access to the media browser. The vulnerability affects all versions before 1.0.8.

An attacker with permissions to create or edit media items or folders can inject malicious scripts that execute in the context of users viewing the media browser, potentially leading to session hijacking, privilege escalation, or other XSS-related impacts. However, the attack surface is limited by the need for elevated permissions to create or edit media content.

Upgrade to version 1.0.8 or later of the media_folders module where this vulnerability is fixed. Since the vulnerability requires specific permissions to exploit, ensure that only trusted users have media creation or editing rights. Patch status is not explicitly confirmed in the input data, but the affectedVersions field indicates that versions prior to 1.0.8 are vulnerable, implying that 1.0.8 contains the fix.