Code Injection Vulnerability in Drupal Linked Field by Drupal
CVE-2026-107259

Currently unrated

Key Information:

Vendor

Drupal
Status
Linked Field
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107259?

A vulnerability has been identified in the Linked Field module for Drupal, enabling attackers to exploit improper neutralization of special elements in a template engine, leading to code injection. This issue impacts multiple versions of the Linked Field module, rendering systems utilizing these affected versions susceptible to unauthorized code execution. Administrators are advised to review and apply necessary updates to mitigate potential threats.

Affected Version(s)

Linked Field 0.0.0 < 1.8.0

References

https://www.drupal.org/sa-contrib-2026-200

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maksim Hayder (tr_jan)
Vitaliy Bogomazyuk (vitaliyb98)
Yannick (yannickoo)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.