- Package
- drupal/datafield
- Fixed in
- 2.0.14
- Published
- Wed 21 Oct 2026, 19:09 Lisbon
In plain words
The file_uri formatter in Data Field does not properly escape filenames when displaying links to uploaded files. An attacker must have a role with permission to upload files into a Data Field file subfield to take advantage of this flaw.
Am I affected?
Look for drupal/datafield and its version in composer.lock. The advisory lists 2.0.14 as fixed but gives no affected version range. Check whether your project uses the file_uri formatter for uploaded-file links and whether users have permission to upload files into a Data Field file subfield.
What to do
Check which version you have, then update to a fixed release for your branch (2.0.14):
composer show drupal/datafield | grep versions
composer update drupal/datafieldIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by requiring an attacker to have a role with permission to upload files into a Data Field file subfield.
The advisory's description
Data Field allows you to create custom fields with multiple values under the default table form.
The file_uri formatter does not properly escape filenames when rendering links to uploaded files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-250
- The week's digest, with the other advisories from 19 Oct 2026
- All advisories for drupal/datafield