PT-2026-120899 · Packagist · Drupal/Custom Formatters
CVE-2026-114524
·
Published
2026-10-21
·
Updated
2026-10-21
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.
The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Drupal/Custom Formatters