CVE-2026-114555

priority · track · 0US

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

1 products

Who says so?

1 sources

osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

No weakness (CWE) mapping recorded.

Products and version ranges known to be affected.

Packagist:https://packages.drupal.org/8 drupal/datafield< 2.0.14osvUSpkg:composer/drupal/datafield?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Vendor and ecosystem advisories describing this.

DRUPAL-CONTRIB-2026-2502026-10-21vendor · osvUS
Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.