drupal/ultimate_table_field - SA-CONTRIB-2026-153
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.
The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.
This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/ultimate_table_field | < 1.1.1, >= 2.0.0, < 2.0.1 | 1.1.1, 2.0.1 |
| Drupal module | drupal/ultimate_table_field | < 1.1.1, >= 2.0.0, < 2.0.1 | 1.1.1, 2.0.1 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/ultimate_table_field- Disclosed
- 09.09.2026
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2026-153 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/ultimate_table_field
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.