Reflection Injection Vulnerability in Drupal Entity List by Drupal
CVE-2026-108099

Currently unrated

Key Information:

Vendor

Drupal
Status
Entity List
Vendor
CVE Published:
30 October 2026

What is CVE-2026-108099?

A vulnerability exists in the Drupal Entity List that allows for Reflection Injection due to the use of externally-controlled input. This issue can lead to significant security risks as it enables attackers to manipulate class selection or code execution, impacting the integrity of the application. Affected versions include all versions from 0.0.0 up to and including 3.0.10. Website administrators should review their systems and apply the necessary updates to mitigate this vulnerability.

Affected Version(s)

Entity List 0.0.0 < 3.0.10

References

https://www.drupal.org/sa-contrib-2026-218

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Octavio Galland (ogalland-tob)
catch (catch)
Lee Rowlands (larowlan)
Dave Long (longwave)
Marc-Antoine MARTY (martygraphie)
Drew Webber (mcdruid)
Jess (xjm)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
catch (catch)
Damien McKenna
Greg Knaddison (greggles)
Tim Hestenes Lehnen (hestenet)
Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Jess (xjm)
.