Project:
Project machine name:
custom_formattersDate:
2026-October-21
Vulnerability:
Remote code execution
Affected versions:
<4.2.1
CVE IDs:
CVE-2026-114524
Description:
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.
The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.
Solution:
Install the latest version:
- If you use Custom Formatters, upgrade to Custom Formatters 4.2.1
Reported By:
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
