{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen meerdere modules binnen Drupal. In de Field UI module en de Entity List module is een remote code execution kwetsbaarheid aanwezig die kan worden misbruikt via contributed modules of custom code, waarbij sommige aanvalspaden geen authenticatie vereisen. De Navigation module, Link module en het Gin administratie thema bevatten cross-site scripting (XSS) kwetsbaarheden veroorzaakt door onvoldoende sanitatie van bepaalde HTML- of URL-attributen. De XSS-kwetsbaarheden kunnen alleen worden misbruikt door gebruikers met specifieke permissies, zoals het invoeren van HTML met bepaalde data-attributen of de \u0027administer menu\u0027 permissie. De kwetsbaarheden zijn specifiek voor Drupal installaties die deze modules of thema\u0027s gebruiken en kunnen leiden tot ongeautoriseerde code-uitvoering of scriptinjectie.\n\nDe kwetsbaarheden zijn niet zondermeer te misbruiken, maar vereisen een plugin of externe module waarmee de kwetsbaarheid kan worden misbruikt. Het is daarom aan te raden om geen gebruik te maken van onbekende, en onvertrouwde, plugins en externe modules.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Drupal heeft updates uitgebracht om de kwetsbaarheden in de genoemde modules en het Gin thema te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Incorrect Permission Assignment for Critical Resource",
        "title": "CWE-732"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.drupal.org/sa-contrib-2026-218"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.drupal.org/sa-contrib-2026-219"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.drupal.org/sa-core-2026-014"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.drupal.org/sa-core-2026-015"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.drupal.org/sa-core-2026-016"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Drupal Core en modules door Drupal",
    "tracking": {
      "current_release_date": "2026-10-19T08:08:49.567699Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0438",
      "initial_release_date": "2026-10-19T08:08:49.567699Z",
      "revision_history": [
        {
          "date": "2026-10-19T08:08:49.567699Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "core"
          }
        ],
        "category": "vendor",
        "name": "Drupal"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "entity_list"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "gin"
          }
        ],
        "category": "vendor",
        "name": "drupal"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-108097",
      "notes": [
        {
          "category": "description",
          "text": "A remote code execution vulnerability exists in Drupal core\u0027s Field UI module, exploitable via contributed or custom modules, with some attacks requiring no authentication and partial mitigation available through Drupal Steward.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-108097 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-108097.json"
        }
      ],
      "title": "CVE-2026-108097"
    },
    {
      "cve": "CVE-2026-108099",
      "notes": [
        {
          "category": "description",
          "text": "The Entity List module, enabling entity list creation without Views, contains a remote code execution vulnerability exploitable via other contributed modules or custom code, with at least one known unauthenticated exploit path.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-108099 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-108099.json"
        }
      ],
      "title": "CVE-2026-108099"
    },
    {
      "cve": "CVE-2026-108514",
      "notes": [
        {
          "category": "description",
          "text": "The Navigation module contains a cross-site scripting (XSS) vulnerability due to insufficient sanitization of certain attributes, exploitable only by users with specific permissions such as \u0027administer menu\u0027 or the ability to enter HTML tags with certain data attributes.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-108514 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-108514.json"
        }
      ],
      "title": "CVE-2026-108514"
    },
    {
      "cve": "CVE-2026-108515",
      "notes": [
        {
          "category": "description",
          "text": "The Drupal core Link module has insufficient sanitization of certain markup in internal and external URLs, leading to cross-site scripting (XSS) vulnerabilities.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-108515 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-108515.json"
        }
      ],
      "title": "CVE-2026-108515"
    },
    {
      "cve": "CVE-2026-110738",
      "notes": [
        {
          "category": "description",
          "text": "Gin, an administration theme providing a modern and customizable backend UI, contains an XSS vulnerability due to insufficient sanitization of certain attributes, exploitable by users with specific HTML input or administer menu permissions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-110738 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110738.json"
        }
      ],
      "title": "CVE-2026-110738"
    }
  ]
}