CVE-2026-107264: Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Published Oct 30, 2026

Updated

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Drupal sites using the Inline Formatter Field module in versions from 0.0.0 through 4.2.0 are affected.

What access does an attacker need?

The CVSS vector indicates that an attacker needs low-level privileges. The issue is remotely exploitable, requires no user interaction, and has low attack complexity.

What is the potential impact of successful exploitation?

The vulnerability allows code injection through server-side template injection. The stated impact includes low-level compromise of confidentiality and integrity, with no availability impact indicated.

CVE-2026-107264: Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the potential impact of successful exploitation?