{"id":"CVE-2026-107260","kind":"vulnerability","aliases":["CVE-2026-107260"],"related":[],"title":"Drupal Sector Distribution: stored cross-site scripting in web page generation","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","summary":"Drupal Sector Distribution has a stored cross-site scripting flaw, where input is not neutralized when pages are generated. An attacker who can store content on the site can run script in other visitors' browsers.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["not-sector-distribution"],"how_to_check":"- Confirm whether the site runs the Drupal Sector Distribution (check the installed profile or composer.json for `drupal/sector` or similar)\n- Check the installed version against the affected ranges: 0.0.0 to 10.3.3 and 10.4.0 to 10.4.2","fix":"- Sector Distribution versions after 10.4.2 are not listed as affected; the exact fixed release is unknown from the sources","status":"open","published_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:37+00:00","updated_at":"2026-10-30T04:31:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:37Z","model":"claude-haiku-5-5","output":{"fix":"- Sector Distribution versions after 10.4.2 are not listed as affected; the exact fixed release is unknown from the sources","reach":"internet","title":"Drupal Sector Distribution: stored cross-site scripting in web page generation","impact":"medium","summary":"Drupal Sector Distribution has a stored cross-site scripting flaw, where input is not neutralized when pages are generated. An attacker who can store content on the site can run script in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Check the Drupal security advisory for the fixed version and which user roles can store the injected content.","how_to_check":"- Confirm whether the site runs the Drupal Sector Distribution (check the installed profile or composer.json for `drupal/sector` or similar)\n- Check the installed version against the affected ranges: 0.0.0 to 10.3.3 and 10.4.0 to 10.4.2","plain_action":"","needs_analyst":true,"not_affected_if":["not-sector-distribution"],"who_is_affected":"Sites built on the Drupal Sector Distribution in the listed version ranges. Exposure depends on which users can store content that is later rendered to other visitors. unknown whether default configurations are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":4129,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107260':15A,18A '-2026':14A,17A '0.0.0':88C '10.3.3':90C '10.4.0':92C '10.4.2':94C 'affect':83C 'allow':78C 'attack':46B 'browser':60B 'content':50B 'cross':6A,32B,70C 'cross-sit':5A,31B,69C 'cve':13A,16A 'distribut':3A,27B,77C,85C 'drupal':1A,19B,25B,75C 'flaw':35B 'generat':12A,44B,68C 'host':24B 'improp':61C 'input':37B,64C 'issu':82C 'neutral':40B,62C 'packag':20B 'page':11A,42B,67C 'php':21B 'run':55B 'script':8A,34B,56B,72C 'sector':2A,26B,76C,84C 'self':23B 'self-host':22B 'site':7A,33B,53B,71C 'store':4A,30B,49B,79C 'version':86C 'visitor':59B 'vulner':73C 'web':10A,66C 'xss':80C","nicknames":[],"mitigations":[],"who_affected":"Sites built on the Drupal Sector Distribution in the listed version ranges. Exposure depends on which users can store content that is later rendered to other visitors. unknown whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107260","severity":null,"published_at":"2026-10-30T04:17:55+00:00","modified_at":"2026-10-30T04:17:55+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}