CVE-2026-107259

The Drupal Linked Field module (versions 0.0.0 to 1.8.0 ) is vulnerable to Server-side Template Injection (SSTI) due to the failure to sufficiently separate field content from template code during rendering. Depending on the installed Twig extensions , an attacker can exploit this to expose site ...

EUVD-2026-113575

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0...

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...

PT-2026-107751

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...