CVE-2026-108099 Drupal CVE debrief

Who should care

Drupal users and administrators who have installed the Entity List module should assess their exposure and verify if other contributed modules create exploitable paths. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and prioritize updating the Entity List module to version 3.0.10 or later if vulnerable.

Why it matters

The Entity List module has a remote code execution vulnerability that can be exploited with other contributed modules, requiring verification of exposure and prioritization of updates.

• Verify exposure in Drupal installations using the Entity List module
• Assess the use of other contributed modules that might create exploitable paths
• Check for custom code that may expose the vulnerable functionality
• Prioritize updating the Entity List module to version 3.0.10 or later if vulnerable

Technical summary

The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. Affected systems should be reviewed for exposure, especially those using the Entity List module, and assess the use of other contributed modules that might create exploitable paths.

Defensive priority

Defenders should prioritize verifying exposure in their Drupal installations, especially those using the Entity List module, and assess the use of other contributed modules that might create exploitable paths.

Recommended defensive actions

• Verify if the Entity List module is installed and enabled
• Assess the use of other contributed modules that might create exploitable paths
• Check for custom code that may expose the vulnerable functionality
• Update the Entity List module to version 3.0.10 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Entity List module, which provides a way to create lists of entities without Views. Multiple serious exploit paths exist with other contributed modules, and at least one known exploit path does not require authentication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.