CVE-2026-107260
Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
- Record
CVE-2026-107260- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-06
EUVDEUVD-2026-113543
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
- Record
EUVD-2026-113543- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-wvqr-g44h-xxjh
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
- Record
GHSA-wvqr-g44h-xxjh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-06
NVD
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
- Record
CVE-2026-107260- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-06
OSV
Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
- Record
CVE-2026-107260- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-229 No score
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
- Record
DRUPAL-CONTRIB-2026-229- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/sectorPackagist |
before 10.3.3, 10.4.0 up to 10.4.2, plus listed versions 10.0.0-alpha110.0.0-alpha1010.0.0-alpha1110.0.0-alpha1210.0.0-alpha2 Show 45 moreShow less10.0.0-alpha310.0.0-alpha410.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-alpha810.0.0-alpha910.0.0-rc110.0.0-rc210.0.0-rc310.0.0-rc410.0.0-rc510.1.0-beta110.1.0-beta1010.1.0-beta1110.1.0-beta1210.1.0-beta1310.1.0-beta1410.1.0-beta210.1.0-beta310.1.0-beta410.1.0-beta510.1.0-beta610.1.0-beta710.1.0-beta810.1.0-beta910.2.0-beta110.3.010.3.0-beta110.3.110.3.210.4.15.0.05.0.0-rc15.0.0-rc25.0.0-rc35.0.15.0.25.0.35.0.45.0.59.1.09.1.0-alpha19.1.0-rc19.1.1 |
10.3.310.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107260 is a medium vulnerability (CVSS 6.5) in Drupal Sector Distribution, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in drupal/sector 10.3.3.
References
Left out here: 36 versions. The JSON record has them.