The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is no...

The Entity List module has a flaw that can allow an attacker to run code remotely. The module alone is not directly exploitable, but other contributed modules can provide exploit paths, including at least one that does not require authentication. Custom code may also expose the vulnerable functionality.

Look for drupal/entity_list and its installed version in composer.lock. The advisory lists 3.0.10 as fixed but does not specify the affected version range. Review other contributed modules and custom code for exposure of the vulnerable functionality; the description does not identify specific modules or code to check.

The Entity List module provides a way to create lists of entities without Views.

The module has a remote code execution vulnerability.

The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.