Project: 
Sector Distribution
Project machine name: 
sector
Date: 
2026-October-21
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site scripting
Affected versions: 
<10.3.3 || >=10.4.0 <10.4.2
CVE IDs: 
CVE-2026-107260
Description: 

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.

A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.

Solution: 

Install the latest version:

  • If you use the 10.3.x Sector distribution, upgrade to Sector 10.3.3
  • If you use the 10.4.x Sector distribution, upgrade to Sector 10.4.2
Reported By: 
Fixed By: 
Coordinated By: