Live › vulnerability › CVE-2026-108099
The Drupal Entity List module lets externally supplied input choose which PHP classes or code get loaded through reflection. The sources do not say what an attacker can run or read after that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Entity List module at version 3.0.10 or earlier are in the affected range, according to the NVD entry. The sources do not say which configurations or user roles make the flaw reachable, so treat any site with the module as potentially exposed until the vendor advisory is read.
No product ranges from the sources yet.
drush pm:list --filter=entity_list or the Extend page in Drupal admin).3.0.10 and earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-108099")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.