Cross-Site Scripting Vulnerability in Drupal Sector Distribution
CVE-2026-107260

Currently unrated

Key Information:

Vendor

Drupal
Status
Sector Distribution
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107260?

A stored Cross-Site Scripting (XSS) vulnerability exists in Drupal's Sector Distribution, which improperly neutralizes input during web page generation. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to data theft or unauthorized actions by other users. The affected versions range from 0.0.0 up to 10.4.2.

Affected Version(s)

Sector Distribution 0.0.0 < 10.3.3

Sector Distribution 10.4.0 < 10.4.2

References

https://www.drupal.org/sa-contrib-2026-229

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Drew Webber (mcdruid)
Soames (somatick)
Swan Kalata (akalata)
Greg Knaddison (greggles)
.