The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. (CVE-2026-114524)
Description
The Custom Formatters module for Drupal allows users to create custom Field Formatters via an admin UI without needing to write a custom module. It executes user-provided PHP code using eval(), enabling arbitrary PHP code execution on the site. The permissions interface does not warn users about this capability. Versions prior to 4.2.1 are affected. A patch is available to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Drupal Custom Formatters module (CVE-2026-114524) arises because the PHP formatter engine uses eval() to run user-supplied PHP code, allowing arbitrary PHP execution. This occurs through the admin UI for creating custom Field Formatters, which does not clearly indicate the security implications in its permissions UI. This flaw affects all versions before 4.2.1 of the module.
Potential Impact
An attacker with access to the admin UI can execute arbitrary PHP code on the affected Drupal site, potentially leading to full site compromise. The lack of clear permission warnings increases the risk of inadvertent exposure to this vulnerability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade the Custom Formatters module to version 4.2.1 or later to remediate the issue. Until patched, restrict access to the admin UI for creating custom Field Formatters to trusted administrators only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- DRUPAL-CONTRIB-2026-225
- Osv Schema Version
- 1.7.0
- Aliases
- ["CVE-2026-114524"]
- Ecosystems
- ["Packagist:https://packages.drupal.org/8"]
Threat ID: 6ad91ca94d27ba8daafa91c4
Added to database: 10/21/2026, 20:12:25 UTC
Last enriched: 10/21/2026, 20:14:44 UTC
Last updated: 10/21/2026, 20:14:44 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.