- Package
- drupal/ultimate_table_field
- Fixed in
- 1.1.1, 2.0.1
- Published
- Wed 9 Sep 2026, 18:24 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon
In plain words
The Ultimate Table Field module does not sufficiently protect the route that opens its cell editor dialog. Anonymous users can open the dialog for any cell type and upload files to the server. Uploads are limited to files with pdf, doc and docx extensions.
Am I affected?
Look for drupal/ultimate_table_field and its version in composer.lock. The advisory lists fixes in 1.1.1 and 2.0.1, but gives no affected version range. It names no configuration or database condition to check beyond the installed version; the cell editor route is accessible to anonymous users.
What to do
Check which version you have, then update to a fixed release for your branch (1.1.1, 2.0.1):
composer show drupal/ultimate_table_field | grep versions
composer update drupal/ultimate_table_fieldIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is partially mitigated by accepting only files with pdf, doc and docx extensions.
The advisory's description
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.
The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.
This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-153
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/ultimate_table_field