SA-CONTRIB-2026-218: Critical severity drupal/entity_list vulnerability
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/entity_listto a version that resolves this vulnerability.Fixed in 3.0.10
Event History
Frequently Asked Questions
Is authentication required to exploit this vulnerability?
Not always. At least one known exploit path involving other contributed modules does not require authentication.
Is installing Entity List by itself sufficient for exploitation?
No. The issue is not directly exploitable with Entity List alone, but serious exploit paths exist when it is used with other contributed modules. Custom code may also expose the vulnerable functionality.
Who should treat this as an urgent exposure?
Sites using Entity List together with other contributed modules, or sites with custom code that exposes the vulnerable functionality, should treat it as urgent. The advisory rates the issue critical.