Vulnerability DRUPAL-CONTRIB-2026-250

Data Field allows you to create custom fields with multiple values under the default table form.

The file_uri formatter does not properly escape filenames when rendering links to uploaded files.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.