CVE-2026-114555

CVE-2026-114555 · DRUPAL-CONTRIB-2026-250

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.

Fix available

Published

2026-10-21T18:09:53Z

Updated

2026-10-21T18:45:02.702928360Z

Stack: php

Check your server →