Project:
Project machine name:
datafieldDate:
2026-October-21
Vulnerability:
Cross site scripting
Affected versions:
<2.0.14
CVE IDs:
CVE-2026-114555
Description:
Data Field allows you to create custom fields with multiple values under the default table form.
The file_uri formatter does not properly escape filenames when rendering links to uploaded files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.
Solution:
Install the latest version:
- If you use the Data Field module, upgrade to Data Field 2.0.14
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
- Drew Webber (mcdruid) of the Drupal Security Team
- Joseph Olstad (joseph.olstad)
- NGUYEN Bao (lazzyvn)
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
