PatchClock

PHP security digest · 21 Oct 2026

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engin...

Unrated CVE-2026-114524

Package
drupal/custom_formatters
Fixed in
4.2.1
Published
Wed 21 Oct 2026, 18:39 Lisbon

In plain words

Someone able to provide PHP code to the Custom Formatters module's PHP formatter engine can execute arbitrary PHP on the site. The engine uses eval() to run that code, but the permissions UI gives no warning about this behaviour.

Am I affected?

Find drupal/custom_formatters and its version in composer.lock. The advisory lists 4.2.1 as fixed but supplies no affected version range. Review whether you use the PHP formatter engine and who can supply code to it; the permissions UI does not flag the PHP execution behaviour.

What to do

Check which version you have, then update to a fixed release for your branch (4.2.1):

composer show drupal/custom_formatters | grep versions
composer update drupal/custom_formatters

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.

The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.