A contributed module is a Drupal extension developed outside the Drupal core codebase. Site administrators can add these modules to provide features or change how a Drupal site works. They are distinct from core modules, which are distributed as part of Drupal itself.
Contributed modules can affect a site's attack surface by making functionality reachable or adding their own code and routes. In some vulnerabilities, an extension or custom implementation may expose a path that core alone does not expose. Defenders should inventory installed modules, keep them updated, and assess how they interact with core features; patching core alone may not address every deployment-specific exposure.