CVE-2026-114555

Data Field allows you to create custom fields with multiple values under the default table form.

The file uri formatter does not properly escape filenames when rendering links to uploaded files.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.