CVE-2026-114555: Drupal Data Field cross-site scripting in file_uri formatter

CVE-2026-114555 · Severity: info · Published 2026-10-30

The Data Field module for Drupal allows administrators to create custom fields with multiple values. An attacker with file upload permissions can inject malicious code through unescaped filenames in file links, potentially compromising other users who view the content. The vulnerability requires authenticated access to the file upload feature, limiting its exposure.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-114555 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114555 being exploited in the wild.
How severe is CVE-2026-114555?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Data Field <2.0.14; Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield ECOSYSTEM:introduced=0,fixed=2.0.14.
Is there a fix for CVE-2026-114555?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.14 or later. Until then: Restrict the permission to upload files into Data Field file subfields to trusted administrative users only until you can upgrade to version 2.0.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114555 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114555?
Check whether you run Drupal Data Field or Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Datafield: upgrade to 2.0.14 or later

Restrict the permission to upload files into Data Field file subfields to trusted administrative users only until you can upgrade to version 2.0.14.

Technical details

The file_uri formatter in Data Field fails to properly escape filenames when rendering links to uploaded files, allowing stored cross-site scripting (XSS). An attacker with the permission to upload files into a Data Field file subfield can craft a malicious filename that executes JavaScript when the link is rendered. This is a stored XSS vulnerability affecting all versions prior to 2.0.14.

Affected products

  • Drupal Data Field <2.0.14

Identifiers

  • CVE-2026-114555
  • DRUPAL-CONTRIB-2026-250

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.