{"id":"DRUPAL-CONTRIB-2026-229","details":"Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.\n\nA module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.","aliases":["CVE-2026-107260"],"modified":"2026-10-21T18:15:02.577863642Z","published":"2026-10-21T17:43:58Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-229"}],"affected":[{"package":{"name":"drupal/sector","ecosystem":"Packagist","purl":"pkg:composer/drupal/sector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.3"}],"database_specific":{"constraint":"\u003c10.3.3"}},{"type":"ECOSYSTEM","events":[{"introduced":"10.4.0"},{"fixed":"10.4.2"}],"database_specific":{"constraint":"\u003e=10.4.0 \u003c10.4.2"}}],"versions":["10.0.0-alpha1","10.0.0-alpha10","10.0.0-alpha11","10.0.0-alpha12","10.0.0-alpha2","10.0.0-alpha3","10.0.0-alpha4","10.0.0-alpha5","10.0.0-alpha6","10.0.0-alpha7","10.0.0-alpha8","10.0.0-alpha9","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","10.0.0-rc4","10.0.0-rc5","10.1.0-beta1","10.1.0-beta10","10.1.0-beta11","10.1.0-beta12","10.1.0-beta13","10.1.0-beta14","10.1.0-beta2","10.1.0-beta3","10.1.0-beta4","10.1.0-beta5","10.1.0-beta6","10.1.0-beta7","10.1.0-beta8","10.1.0-beta9","10.2.0-beta1","10.3.0","10.3.0-beta1","10.3.1","10.3.2","10.4.0","10.4.1","5.0.0","5.0.0-rc1","5.0.0-rc2","5.0.0-rc3","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","9.1.0","9.1.0-alpha1","9.1.0-rc1","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.2.0","9.2.1","9.2.10","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.1","9.3.2","9.3.3","9.3.4","9.3.5","9.3.6","9.4.0","9.4.1","9.5.0","9.5.1","9.5.2","9.5.3","9.5.4","9.5.5","9.5.6","9.5.7","9.5.8"],"database_specific":{"affected_versions":"\u003c10.3.3 || \u003e=10.4.0 \u003c10.4.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/sector/DRUPAL-CONTRIB-2026-229.json"}}],"schema_version":"1.9.0","credits":[{"name":"Drew Webber (mcdruid)","contact":["https://www.drupal.org/u/mcdruid"]}]}