[ CVE-2026-108099 · Published 30 Oct 2026 ]

Vulnerability in Drupal Entity List

Not scored yet EPSS <1%2 agency advisoriesFix available

[ Why it matters ]Priority signals

Interim mitigation published by PrivacySafe

[ Description ]Official description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

[ Fixes ]Fixes and patches

Drupal core Field UI and Entity ListInterim mitigation · PrivacySafe · Check, Drupal's Field UI workaround (`mitigate`) and rollback for Drupal 8.9 to 12 sites on GNU/Linux (end-of-life branches move to a supported branch) and the contributed Entity List module

[ Advisories ]Government CERT advisories

NCSC-NL19 Oct 2026NCSC-2026-0438

Vulnerabilities fixed in Drupal Core and modules by Drupal Translated from Dutch
Probability/damage M/HCVE-2026-108097CVE-2026-108099CVE-2026-108514+2 more CVEs
BSI CERT-Bund14 Oct 2026WID-SEC-2026-3968

Drupal Core, Gin Admin Theme and Entity List: Multiple vulnerabilities Translated from German
CVE-2026-108097CVE-2026-108515CVE-2026-110738+2 more CVEs

[ References ]References

www.drupal.org/sa-contrib-2026-218