CVE-2026-114524 Drupal CVE debrief

Who should care

Drupal site administrators, security teams, and developers who use the Custom Formatters module should be aware of this vulnerability and take steps to verify exposure and apply patches.

Why it matters

The Custom Formatters module for Drupal allows arbitrary PHP execution, potentially leading to unauthorized access and control of the site. Site administrators and security teams should prioritize verifying exposure and applying patches.

• Potential for arbitrary PHP execution on the site
• Possible unauthorized use of the PHP formatter engine
• Need for verification of user permissions and access controls
• Requirement for updating to version 4.2.1 or later

Technical summary

The Custom Formatters module for Drupal uses eval() to execute user-provided PHP code in the PHP formatter engine. This allows arbitrary PHP execution on the site. The permissions UI does not indicate this behavior, potentially allowing unauthorized users to exploit this vulnerability. The vulnerability affects versions less than 4.2.1, and a fix is available in version 4.2.1. Site administrators and security teams should prioritize verifying exposure and applying patches due to the potential for arbitrary PHP execution.

Defensive priority

Drupal site administrators and security teams should prioritize verifying exposure and applying patches due to the potential for arbitrary PHP execution.

Recommended defensive actions

• Verify if the Custom Formatters module is installed and enabled on your Drupal site
• Check the version of the Custom Formatters module and update to 4.2.1 or later if necessary
• Review user permissions and access controls to prevent unauthorized use of the PHP formatter engine
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides limited information about affected versions and remediation. According to the source, versions less than 4.2.1 are affected, and a fix is available in version 4.2.1. However, the source does not provide explicit evidence of the vulnerability's impact or details about the affected scope. Defenders should verify the vulnerability's presence in their environments and review user permissions and access controls to prevent unauthorized use of the PHP formatter engine.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.