DRUPAL-CONTRIB-2026-229

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2026-229

    DRUPAL-CONTRIB-2026-229

    Published: 21 Oct 2026Last Modified: 21 Oct 2026

    Summary:

    Details: Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.

    References: https://www.drupal.org/sa-contrib-2026-229

    Affected packages

    Package

    Name: drupal/sector

    Purl: pkg:composer/drupal/sector

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -10.3.3

    Affected versions

    10.0.0-alpha1
    10.0.0-alpha10
    10.0.0-alpha11
    10.0.0-alpha12
    10.0.0-alpha2
    10.0.0-alpha3
    10.0.0-alpha4
    10.0.0-alpha5
    10.0.0-alpha6
    10.0.0-alpha7
    10.0.0-alpha8
    10.0.0-alpha9
    10.0.0-rc1
    10.0.0-rc2
    10.0.0-rc3
    10.0.0-rc4
    10.0.0-rc5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2026-229 | CVE-DB