Is CVE-2026-107260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107260 being exploited in the wild.

How severe is CVE-2026-107260?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Drupal Sector all versions before 10.3.3, and 10.4.0 through 10.4.1; drupal/sector (Packagist) ECOSYSTEM:introduced=0,fixed=10.3.3|ECOSYSTEM:introduced=10.4.0,fixed=10.4.2.

Is there a fix for CVE-2026-107260?

Yes. drupal/sector (Packagist): upgrade to 10.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107260 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107260?

Check whether you run Drupal Sector or drupal/sector (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107260: Drupal Sector distribution cross-site scripting in media names

CVE-2026-107260 · Severity: info · Published 2026-10-30

Sector is a pre-configured Drupal distribution for site builders. A module in this distribution fails to sanitize media entity names, allowing authenticated users with media editing permissions to inject malicious scripts that execute in other users' browsers. This could lead to account takeover or data theft for administrators and site managers.

Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-107260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107260 being exploited in the wild.
How severe is CVE-2026-107260?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal Sector all versions before 10.3.3, and 10.4.0 through 10.4.1; drupal/sector (Packagist) ECOSYSTEM:introduced=0,fixed=10.3.3|ECOSYSTEM:introduced=10.4.0,fixed=10.4.2.
Is there a fix for CVE-2026-107260?: Yes. drupal/sector (Packagist): upgrade to 10.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107260 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107260?: Check whether you run Drupal Sector or drupal/sector (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

drupal/sector (Packagist): upgrade to 10.3.3 or later
```
composer require drupal/sector:^10.3.3
```

Technical details

The vulnerability is an improper output encoding flaw in a Sector distribution-specific module that handles media entity names. It requires an attacker to have a role with permission to create or edit media entities, and the injected script executes when other users view the affected media. The attack vector is authenticated user action within the Drupal admin interface.

Affected products

Drupal Sector all versions before 10.3.3, and 10.4.0 through 10.4.1

Identifiers

CVE-2026-107260
DRUPAL-CONTRIB-2026-229

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.