DRUPAL-CONTRIB-2026-229
See a problem?- Import Source
- https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/sector/DRUPAL-CONTRIB-2026-229.json
- JSON Data
- https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-229
- Aliases
-
- CVE-2026-107260
- Published
- 2026-10-21T17:43:58Z
- Modified
- 2026-10-21T18:15:02Z
- Summary
- [none]
- Details
-
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
- References
- Credits
-
-
- Drew Webber (mcdruid)
-
Affected packages
Packagist / drupal/sector
Package
- Name
- drupal/sector
- Purl
- pkg:composer/drupal/sector
Affected versions
5.*
5.0.0-rc1
5.0.0-rc2
5.0.0-rc3
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
9.*
9.1.0-alpha1
9.1.0-rc1
9.1.0
9.1.1
9.1.2
9.1.3
9.1.4
9.1.5
9.1.6
9.1.7
9.1.8
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.2.7
9.2.8
9.2.9
9.2.10
9.3.0
9.3.1
9.3.2
9.3.3
9.3.4
9.3.5
9.3.6
9.4.0
9.4.1
9.5.0
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.5.6
9.5.7
9.5.8
10.*
10.0.0-alpha1
10.0.0-alpha2
10.0.0-alpha3
10.0.0-alpha4
10.0.0-alpha5
10.0.0-alpha6
10.0.0-alpha7
10.0.0-alpha8
10.0.0-alpha9
10.0.0-alpha10
10.0.0-alpha11
10.0.0-alpha12
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
10.0.0-rc4
10.0.0-rc5
10.1.0-beta1
10.1.0-beta2
10.1.0-beta3
10.1.0-beta4
10.1.0-beta5
10.1.0-beta6
10.1.0-beta7
10.1.0-beta8
10.1.0-beta9
10.1.0-beta10
10.1.0-beta11
10.1.0-beta12
10.1.0-beta13
10.1.0-beta14
10.2.0-beta1
10.3.0-beta1
10.3.0
10.3.1
10.3.2
10.4.0
10.4.1