{"id":"CVE-2026-108099","kind":"vulnerability","aliases":["CVE-2026-108099"],"related":[],"title":"Drupal Entity List: unsafe reflection lets input select classes to run","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.","summary":"The Drupal Entity List module lets externally supplied input choose which PHP classes or code get loaded through reflection. The sources do not say what an attacker can run or read after that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the site runs the Drupal Entity List module (`drush pm:list --filter=entity_list` or the Extend page in Drupal admin).\n- Compare the installed version against the affected range, `3.0.10` and earlier.","fix":"- Drupal Entity List: unknown, the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:04+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:20+00:00","updated_at":"2026-10-30T04:31:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:20Z","model":"claude-haiku-5-5","output":{"fix":"- Drupal Entity List: unknown, the sources do not name a fixed version.","reach":"unknown","title":"Drupal Entity List: unsafe reflection lets input select classes to run","impact":"high","summary":"The Drupal Entity List module lets externally supplied input choose which PHP classes or code get loaded through reflection. The sources do not say what an attacker can run or read after that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; reflection injection may allow arbitrary code execution","analyst_note":"Read the Drupal security advisory for Entity List to confirm the fixed version, the trigger conditions and whether unauthenticated requests reach the flaw (https://nvd.nist.gov/vuln/detail/CVE-2026-108099).","how_to_check":"- Check whether the site runs the Drupal Entity List module (`drush pm:list --filter=entity_list` or the Extend page in Drupal admin).\n- Compare the installed version against the affected range, `3.0.10` and earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Entity List module at version 3.0.10 or earlier are in the affected range, according to the NVD entry. The sources do not say which configurations or user roles make the flaw reachable, so treat any site with the module as potentially exposed until the vendor advisory is read.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000703,"input_tokens":4116,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108099':14A,17A '-2026':13A,16A '0.0.0':83C '3.0.10':85C 'affect':78C 'allow':73C 'attack':50B 'choos':33B 'class':9A,36B,63C 'code':38B,65C 'control':59C 'cve':12A,15A 'drupal':1A,18B,25B,70C 'entiti':2A,26B,71C,79C 'extern':30B,58C 'externally-control':57C 'get':39B 'host':23B 'inject':75C 'input':7A,32B,60C 'issu':77C 'let':6A,29B 'list':3A,27B,72C,80C 'load':40B 'modul':28B 'packag':19B 'php':20B,35B 'read':54B 'reflect':5A,42B,67C,74C 'run':11A,52B 'say':47B 'select':8A,62C 'self':22B 'self-host':21B 'sourc':44B 'suppli':31B 'unsaf':4A,66C 'use':55C 'version':81C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Entity List module at version 3.0.10 or earlier are in the affected range, according to the NVD entry. The sources do not say which configurations or user roles make the flaw reachable, so treat any site with the module as potentially exposed until the vendor advisory is read.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108099","severity":null,"published_at":"2026-10-30T04:18:04+00:00","modified_at":"2026-10-30T04:18:04+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}