CVE-2026-114555 Drupal CVE debrief

Who should care

Drupal administrators and security teams should assess exposure and prioritize verification and potential upgrades for the Data Field module. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Drupal installations, particularly those using the Data Field module.

Why it matters

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Drupal installations, particularly those using the Data Field module. The vulnerability requires an attacker to have specific permissions, but could still lead to security issues if exploited.

• Verify and potentially upgrade the Data Field module to version 2.0.14 or later
• Assess user roles and permissions for file upload access to mitigate exploitation
• Monitor for potential file upload abuse by users with elevated permissions

Technical summary

The `file_uri` formatter in the Data Field module for Drupal does not properly escape filenames when rendering links to uploaded files. This vulnerability requires an attacker to have a role with permission to upload files into a Data Field file subfield. The vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Drupal installations, particularly those using the Data Field module.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Drupal installations, particularly those using the Data Field module.

Recommended defensive actions

• Verify if the Data Field module is installed and enabled
• Check if the installed version is prior to 2.0.14
• Assess user roles and permissions for file upload access
• Consider upgrading to version 2.0.14 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in the Data Field module versions prior to 2.0.14. Official sources, including the CVE Program and NVD, provide additional context. The vulnerability requires an attacker to have specific permissions, but could still lead to security issues if exploited. Defenders should verify exposure and assess the impact on their Drupal installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.