CVE-2026-108099
The Entity List module provides a way to create lists of entities without Views.
Published Oct 14, 2026 · updated Oct 14, 2026
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.
Oct 14, 2026 · OSV.dev
Fix available
drupal/entity_list fixed in 3.0.10
Oct 14, 2026 · OSV.dev
Fix available
drupal/entity_list fixed in 3.0.10
Oct 14, 2026 · OSV.dev
Updated
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.
Affected
- Packagist:https://packages.drupal.org/8 drupal/entity_list0 → 3.0.10