CVE-2026-107259 - Vulnerability Details - OpenCVE

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Linked Field

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-200

History

Sat, 31 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 30 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal linked Field
Vendors & Products		Drupal Drupal linked Field

Fri, 30 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}`

Fri, 30 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
Title		Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
Weaknesses		CWE-1336
References		https://www.drupal.org/sa-contrib-2026-200

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-30T03:10:15.793Z

Updated: 2026-10-30T20:05:19.615Z

Reserved: 2026-10-07T15:25:19.994Z

Link: CVE-2026-107259

Vulnrichment

Updated: 2026-10-30T20:05:13.573Z

NVD

Status : Awaiting Analysis

Published: 2026-10-30T04:17:55.090

Modified: 2026-10-30T20:16:56.130

Link: CVE-2026-107259

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107259", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-10-07T15:25:19.994Z", "datePublished": "2026-10-30T03:10:15.793Z", "dateUpdated": "2026-10-30T20:05:19.615Z"}, "containers": {"cna": {"title": "Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200", "datePublic": "2026-10-07T16:23:38.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-200"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/linked_field", "product": "Linked Field", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/linked_field", "versions": [{"lessThan": "1.8.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0."}], "credits": [{"lang": "en", "type": "finder", "value": "Maksim Hayder (tr_jan)"}, {"lang": "en", "type": "remediation developer", "value": "Vitaliy Bogomazyuk (vitaliyb98)"}, {"lang": "en", "type": "remediation developer", "value": "Yannick (yannickoo)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:15.793Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T20:05:16.316508Z", "id": "CVE-2026-107259", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:05:19.615Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T20:05:16.316508Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:05:13.573Z"}}], "cna": {"title": "Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200", "credits": [{"lang": "en", "type": "finder", "value": "Maksim Hayder (tr_jan)"}, {"lang": "en", "type": "remediation developer", "value": "Vitaliy Bogomazyuk (vitaliyb98)"}, {"lang": "en", "type": "remediation developer", "value": "Yannick (yannickoo)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/linked_field", "vendor": "Drupal", "product": "Linked Field", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.8.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/linked_field"}], "datePublic": "2026-10-07T16:23:38.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-200"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:15.793Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107259", "state": "PUBLISHED", "dateUpdated": "2026-10-30T20:05:19.615Z", "dateReserved": "2026-10-07T15:25:19.994Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-30T03:10:15.793Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}