CVE-2026-107259: Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
Published Oct 30, 2026
·Updated
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Drupal sites using the Linked Field module in versions from 0.0.0 through 1.8.0 are affected.
2
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges. Exploitation is network-accessible and does not require user interaction.
3
What is the potential impact of successful exploitation?
The vulnerability allows code injection through server-side template injection. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.