SA-CONTRIB-2026-225: Critical severity drupal/custom_formatters vulnerability

Q: What level of access would an attacker need?

An attacker would need access to the Custom Formatters administrative UI sufficient to create or modify a formatter and supply PHP code. The available data does not identify the specific permission name or role.

Q: Why could this be overlooked during access reviews?

The permissions UI does not indicate that the formatter capability can execute PHP. Administrators may therefore grant access without recognizing that it enables arbitrary PHP execution.

Published Oct 21, 2026

Updated

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/custom_formatters<4.2.1

4.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/custom_formatters to a version that resolves this vulnerability.
Fixed in 4.2.1

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114524

Frequently Asked Questions

What level of access would an attacker need?

An attacker would need access to the Custom Formatters administrative UI sufficient to create or modify a formatter and supply PHP code. The available data does not identify the specific permission name or role.

Why could this be overlooked during access reviews?

The permissions UI does not indicate that the formatter capability can execute PHP. Administrators may therefore grant access without recognizing that it enables arbitrary PHP execution.

SA-CONTRIB-2026-225: Critical severity drupal/custom_formatters vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access would an attacker need?

Why could this be overlooked during access reviews?

Company

Resources

Contact

Frequently Asked Questions

What level of access would an attacker need?

Why could this be overlooked during access reviews?