{"id":"CVE-2026-107259","kind":"vulnerability","aliases":["CVE-2026-107259"],"related":[],"title":"Drupal Linked Field: template engine flaw allows code injection","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.","summary":"The Drupal Linked Field module fails to neutralize special elements used in a template engine, which allows code injection. Affected versions are listed as 0.0.0 through 1.8.0 in the source.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Drupal Linked Field module is installed and its version, for example with `drush pm:list` or the module list at `/admin/modules`\n- Compare the installed version against the affected range `0.0.0` to `1.8.0`","fix":null,"status":"open","published_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:37+00:00","updated_at":"2026-10-30T04:31:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Drupal Linked Field: template engine flaw allows code injection","impact":"high","summary":"The Drupal Linked Field module fails to neutralize special elements used in a template engine, which allows code injection. Affected versions are listed as 0.0.0 through 1.8.0 in the source.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","cms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; the source names code injection, impact not detailed","analyst_note":"Find the Drupal security advisory for Linked Field and the NVD entry details: fixed version, required privileges and whether the flaw is reachable without an account.","how_to_check":"- Check whether the Drupal Linked Field module is installed and its version, for example with `drush pm:list` or the module list at `/admin/modules`\n- Compare the installed version against the affected range `0.0.0` to `1.8.0`","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal with the Linked Field module in the listed version range are in scope. The sources do not say whether a default configuration or a logged-in account is needed to trigger the flaw, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4096,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107259':12A,15A '-2026':11A,14A '0.0.0':44B,75C '1.8.0':46B,77C 'affect':39B,70C 'allow':7A,36B,65C 'cms':16B 'code':8A,37B,66C 'cve':10A,13A 'drupal':1A,17B,21B,62C 'element':29B,54C 'engin':5A,34B,59C 'fail':25B 'field':3A,23B,64C,72C 'flaw':6A 'improp':50C 'inject':9A,38B,67C 'issu':69C 'link':2A,22B,63C,71C 'list':42B 'modul':24B 'neutral':27B,51C 'packag':18B 'php':19B 'sourc':49B 'special':28B,53C 'templat':4A,33B,58C 'use':30B,55C 'version':40B,73C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Linked Field module in the listed version range are in scope. The sources do not say whether a default configuration or a logged-in account is needed to trigger the flaw, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107259","severity":null,"published_at":"2026-10-30T04:17:55+00:00","modified_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}