Project:
Project machine name:
entity_listDate:
2026-October-14
Vulnerability:
Remote code execution
Affected versions:
<3.0.10
CVE IDs:
CVE-2026-108099
Description:
The Entity List module provides a way to create lists of entities without Views.
The module has a remote code execution vulnerability.
The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.
Solution:
Install the latest version:
- Upgrade to Entity List 3.0.10.
Reported By:
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Octavio Galland (ogalland-tob)
Fixed By:
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Marc-Antoine MARTY (martygraphie)
- Drew Webber (mcdruid) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Tim Hestenes Lehnen (hestenet)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
