CVE-2026-107259

Keine CWE-Zuordnung erfasst.

• Open Source Drupal Actstream <2.0.1alle Versionencert_bundDE
• Open Source Drupal Actstream <2.1.1alle Versionencert_bundDE
• Open Source Drupal Advanced Filesystem <1.0.28alle Versionencert_bundDE
• Open Source Drupal Authenticator Login Plus (2FA) <1.0.1alle Versionencert_bundDE
• Open Source Drupal Block AJAX <3.0.2alle Versionencert_bundDE
• Open Source Drupal Country <2.1.3alle Versionencert_bundDE
• Open Source Drupal Country <2.2.1alle Versionencert_bundDE
• Open Source Drupal DKAN <4.0.4alle Versionencert_bundDE
• Open Source Drupal DKAN <4.1.5alle Versionencert_bundDE
• Open Source Drupal ECA Helperalle Versionencert_bundDEcpe:/a:drupal:drupal:eca_helper
• Open Source Drupal Easy Breadcrumb <2.0.11alle Versionencert_bundDE
• Open Source Drupal Entity Reference Manager (Merge entities) <1.0.3alle Versionencert_bundDE
• Open Source Drupal Examples for Developers <4.0.7alle Versionencert_bundDE
• Open Source Drupal Freelinking <4.0.3alle Versionencert_bundDE
• Open Source Drupal Gutenberg <2.15.0alle Versionencert_bundDE
• Open Source Drupal Gutenberg <3.0.7alle Versionencert_bundDE
• Open Source Drupal Inline Entity Form Dialog <1.0.6alle Versionencert_bundDE
• Open Source Drupal Inline Formatter Field <4.2.0alle Versionencert_bundDE
• Open Source Drupal Leaflet <10.4.13alle Versionencert_bundDE
• Open Source Drupal Linked Field <1.8.0alle Versionencert_bundDE

• WID-SEC-W-2026-3819Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE

  Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

• DRUPAL-CONTRIB-2026-2002026-10-07vendor · osvUS

  This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.