CVE-2026-107260

Name of the Vulnerable Software and Affected Versions Drupal Sector Distribution versions 0.0.0 through 10.3.3 Drupal Sector Distribution versions 10.4.0 through 10.4.2

Description An issue exists where a module specific to the distribution does not sufficiently sanitize media names, allowing for Stored Cross-site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or encoding. Exploitation requires the attacker to possess a role with permissions to create or edit a media entity.

Recommendations Update Drupal Sector Distribution versions 0.0.0 through 10.3.3 to a version newer than 10.3.3. Update Drupal Sector Distribution versions 10.4.0 through 10.4.2 to a version newer than 10.4.2.