- Drupal core’s Field UI module contains a critical remote code execution vulnerability tracked as CVE-2026-108097, rated 19 out of 25 on Drupal’s risk scale.
- Fixes were released on October 14 in versions 11.4.10, 11.3.19, and 10.6.19; sites on end-of-life branches remain exposed.
- At least one exploit path requires no login, but no public exploits or attacks have been reported as of October 15.
- Uninstalling the Field UI module provides temporary protection until sites can update.
A critical remote code execution vulnerability in Drupal’s core Field UI module, tracked as CVE-2026-108097, allows an attacker to run arbitrary code on the server, and the Drupal Security Team shipped fixes on October 14 for supported branches. The flaw cannot be reached through core alone, but several paths exist through contributed modules, including at least one unauthenticated route, according to the advisory.
Drupal rates the vulnerability 19 out of 25 on its own risk scale, the level the project calls critical. The advisory does not name the contributed modules or custom code that can expose the flaw, but Drew Webber and Octavio Galland are credited with its discovery.
The fixed releases are Drupal 11.4.10, 11.3.19, and 10.6.10; the beta for version 12.0.0 is also patched but not for production use. During the week starting October 4, 28.5% of sites reporting their core version to drupal.org were on an unfixed, end-of-life branch. Both 11.3.x and 10.6.x lose security coverage in December 2026.
Sites that cannot update immediately can uninstall the Field UI module (field_ui), which the advisory says “will provide protection while sites are updated.” The module is installed by default in the Standard install profile. Drupal Steward, a web application firewall service, already blocks some attack vectors for this flaw, but does not cover every possible exploit.
The Security Team pre-announced the release on October 12 and urged sites to reserve time because exploits might be developed within hours or days. No public exploit code or attacks have surfaced as of October 15.
The fix changes how Field UI builds its admin tables: the pre-render step no longer calls arbitrary PHP callables via call_user_func_array. Previously, the #region_callback property on table rows was executed without validation, bypassing a render callback restriction added in Drupal 8.8. The updated code reads each row’s region directly and ignores custom callbacks.
Additionally, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with similar conditions. Its 3.0.10 release note mirrors the Field UI fix, and updating core does not automatically update the module. The same core releases also patch two moderately critical cross-site scripting flaws in the Link module and Navigation module. Drupal 7, which reached end of life in January 2025, has a backport of the fix from Pantheon’s long-term support with Tag1 Consulting.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Musk Praises Micron Memory Pricing, Boosts MU Stock Forecast
- Solana Cuts Finality From 12.8 Seconds to 150 Milliseconds
- TSMC in talks with Musk’s Terafab, insists on running the plant
- Crypto hacks hit $1.18B in Q3 as third-party tools exploited
- GhostAction targets 30k GitHub repos in new supply chain wave
