View online: https://www.drupal.org/sa-contrib-2026-229 Project: Sector Distribution [1] Project machine name: sector Date: 2026-October-21 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <10.3.3 || >=10.4.0 <10.4.2 CVE IDs: CVE-2026-107260 Description: Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity. Solution: Install the latest version: * If you use the 10.3.x Sector distribution, upgrade to Sector 10.3.3 [3] * If you use the 10.4.x Sector distribution, upgrade to Sector 10.4.2 [4] Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [6] of the Drupal Security Team * Soames (somatick) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/sector [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/sector/releases/10.3.3 [4] https://www.drupal.org/project/sector/releases/10.4.2 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/somatick [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....