{"id":"CVE-2026-107260","aliases":["DRUPAL-CONTRIB-2026-229","EUVD-2026-113543","GHSA-wvqr-g44h-xxjh"],"status":"published","title":"Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00161,"percentile":0.05317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-21T17:43:58Z","modified":"2026-11-06T15:36:54Z","fixes":[{"ecosystem":"Packagist","package":"drupal/sector","fixed_in":["10.3.3","10.4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist","package":"drupal/sector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.3"}]},{"type":"ECOSYSTEM","events":[{"introduced":"10.4.0"},{"fixed":"10.4.2"}]}],"versions":["10.0.0-alpha1","10.0.0-alpha10","10.0.0-alpha11","10.0.0-alpha12","10.0.0-alpha2","10.0.0-alpha3","10.0.0-alpha4","10.0.0-alpha5","10.0.0-alpha6","10.0.0-alpha7","10.0.0-alpha8","10.0.0-alpha9","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","10.0.0-rc4","10.0.0-rc5","10.1.0-beta1","10.1.0-beta10","10.1.0-beta11","10.1.0-beta12","10.1.0-beta13","10.1.0-beta14","10.1.0-beta2","10.1.0-beta3","10.1.0-beta4","10.1.0-beta5","10.1.0-beta6","10.1.0-beta7","10.1.0-beta8","10.1.0-beta9","10.2.0-beta1","10.3.0","10.3.0-beta1","10.3.1","10.3.2","10.4.0","10.4.1","5.0.0","5.0.0-rc1","5.0.0-rc2","5.0.0-rc3","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","9.1.0","9.1.0-alpha1","9.1.0-rc1","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.2.0","9.2.1","9.2.10","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.1","9.3.2","9.3.3","9.3.4","9.3.5","9.3.6","9.4.0","9.4.1","9.5.0","9.5.1","9.5.2","9.5.3","9.5.4","9.5.5","9.5.6","9.5.7","9.5.8"]}],"products":[{"vendor":"drupal","product":"sector distribution"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-229","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107260","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wvqr-g44h-xxjh"},{"url":"https://git.drupalcode.org/project/sector","tags":["web"]},{"url":"https://www.drupal.org/project/sector","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107260.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-107260","title":"Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","status":"published","published":"2026-10-30T03:09:39.913Z","modified":"2026-11-06T15:36:54.617Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T16:58:45.944646Z"}],"euvd":[{"id":"EUVD-2026-113543","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","status":"published","published":"2026-10-30T03:09:39Z","modified":"2026-11-06T15:36:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T17:05:30.736613Z"}],"ghsa":[{"id":"GHSA-wvqr-g44h-xxjh","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","status":"published","published":"2026-10-30T06:31:50Z","modified":"2026-11-06T18:34:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T19:01:26.771329Z"}],"nvd":[{"id":"CVE-2026-107260","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","status":"published","published":"2026-10-30T04:17:55.36Z","modified":"2026-11-06T16:17:35.703Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T18:00:55.191747Z"}],"osv":[{"id":"CVE-2026-107260","title":"Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.","status":"published","published":"2026-10-30T03:09:39.913Z","modified":"2026-11-08T02:30:47.862335625Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:07:59.958523Z"},{"id":"DRUPAL-CONTRIB-2026-229","description":"Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.\n\nA module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.","status":"published","published":"2026-10-21T17:43:58Z","modified":"2026-10-21T18:15:02.577863642Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}