Drupal Linked Field EUVD-2026-113575

Exploitation requires an authenticated Drupal account whose role can configure the Linked Field module's formatter/display settings (the field-display configuration where template syntax is accepted); this is a trusted administrative-style permission, so it is not a remote-unauthenticated attack against default configurations. Limiting factors: the attacker must already hold this configuration privilege (PR:L), the affected site must run Linked Field at a version below 1.8.0, and the payload executes in the site's server context. The exact configuration field or deployment mode that carries the injectable template input is not described in the available sources.

This is a moderate-priority issue, not an emergency. The vendor CVSS is 5.4 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, meaning network-reachable, low complexity, but requiring an authenticated account (PR:L) and scoring only Low confidentiality/integrity impact with no availability impact. Corroborating signals point to low urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit is referenced. The vuln.today decision label is 'this_month' rather than act_now/emergency, which is consistent with those signals. However, there is a notable tension worth flagging: the vulnerability is Code Injection into a template engine (CWE-1336, SSTI), a class that typically yields server-side code execution with high impact, yet the input CVSS rates impact as only C:L/I:L/A:N. This likely reflects that exploitation is gated behind a trusted configuration privilege rather than that the technical ceiling is low - so defenders whose Drupal sites grant field-display/configuration permissions to lower-trust roles should treat the real impact as higher than the 5.4 implies. Net: prioritize for patching this month; it is a genuine SSTI but its real-world risk is bounded by the required privilege level and the absence of exploitation evidence.

An authenticated user who holds permission to configure the Linked Field formatter settings enters template-engine syntax into a Linked Field configuration field; because the input is not properly neutralized, the template engine evaluates the attacker's payload server-side, resulting in code injection. No public exploit is referenced, and the exact field/setting that carries the payload is not described in the available sources.