---
id: "CVE-2026-108099"
kind: "vulnerability"
aliases: ["CVE-2026-108099"]
title: "Drupal Entity List: unsafe reflection lets input select classes to run"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:04+00:00"
first_seen_at: "2026-10-30T04:28:36+00:00"
updated_at: "2026-10-30T04:31:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108099", "first_seen_at": "2026-10-30T04:28:36+00:00"}]
---

# Drupal Entity List: unsafe reflection lets input select classes to run

The Drupal Entity List module lets externally supplied input choose which PHP classes or code get loaded through reflection. The sources do not say what an attacker can run or read after that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the site runs the Drupal Entity List module (`drush pm:list --filter=entity_list` or the Extend page in Drupal admin).
- Compare the installed version against the affected range, `3.0.10` and earlier.

## Fix

- Drupal Entity List: unknown, the sources do not name a fixed version.

## Timeline

- 2026-10-30T04:28:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108099

## From the sources

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity  List allows Reflection Injection. This issue affects Entity  List versions: from 0.0.0 to 3.0.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_