DRUPAL-CONTRIB-2026-225

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/custom_formatters/DRUPAL-CONTRIB-2026-225.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-225

Aliases

CVE-2026-114524

Published

2026-10-21T17:39:16Z

Modified

2026-10-21T18:15:04Z

Summary

[none]

Details

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.

The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.

References

https://www.drupal.org/sa-contrib-2026-225

Credits

- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/custom_formatters

Package

Name: drupal/custom_formatters
Purl: pkg:composer/drupal/custom_formatters?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

4.2.1

Database specific

Show details

{
    "constraint":  "<4.2.1"
}

Database specific

affected_versions

"<4.2.1"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/custom_formatters/DRUPAL-CONTRIB-2026-225.json"