CVE-2026-107260
CVE-2026-107260 · DRUPAL-CONTRIB-2026-229
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal/sector Packagist
- Versions
- 10.0.0-alpha1
- 10.0.0-alpha10
- 10.0.0-alpha11
- 10.0.0-alpha12
- 10.0.0-alpha2
- 10.0.0-alpha3
- 10.0.0-alpha4
- 10.0.0-alpha5
- 10.0.0-alpha6
- 10.0.0-alpha7
- 10.0.0-alpha8
- 10.0.0-alpha9
- 10.0.0-rc1
- 10.0.0-rc2
- 10.0.0-rc3
- 10.0.0-rc4
- 10.0.0-rc5
- 10.1.0-beta1
- 10.1.0-beta10
- 10.1.0-beta11
- 10.1.0-beta12
- 10.1.0-beta13
- 10.1.0-beta14
- 10.1.0-beta2
- 10.1.0-beta3
- 10.1.0-beta4
- 10.1.0-beta5
- 10.1.0-beta6
- 10.1.0-beta7
- 10.1.0-beta8
- 10.1.0-beta9
- 10.2.0-beta1
- 10.3.0
- 10.3.0-beta1
- 10.3.1
- 10.3.2
- 10.4.0
- 10.4.1
- 5.0.0
- 5.0.0-rc1
- 5.0.0-rc2
- 5.0.0-rc3
- 5.0.1
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 9.1.0
- 9.1.0-alpha1
- 9.1.0-rc1
- 9.1.1
- 9.1.2
- 9.1.3
- 9.1.4
- 9.1.5
- 9.1.6
- 9.1.7
- 9.1.8
- 9.2.0
- 9.2.1
- 9.2.10
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.2.7
- 9.2.8
- 9.2.9
- 9.3.0
- 9.3.1
- 9.3.2
- 9.3.3
- 9.3.4
- 9.3.5
- 9.3.6
- 9.4.0
- 9.4.1
- 9.5.0
- 9.5.1
- 9.5.2
- 9.5.3
- 9.5.4
- 9.5.5
- 9.5.6
- 9.5.7
- 9.5.8
- Affected ranges
- ECOSYSTEM: < 10.3.3
- ECOSYSTEM: ≥ 10.4.0, < 10.4.2
Update to 10.3.3; Update to 10.4.2