Drupal Patches Critical Field UI RCE Flaw Requiring Contributed Module Exposure
Summary
Drupal fixed a critical Field UI code-execution flaw in versions 11.4.10, 11.3.19 and 10.6.19. A contributed module or custom code must expose an exploit path; no public exploit code or attacks were reported as of October 15.
Key points
- CVE-2026-108097 affects Drupal Field UI. The advisory says exploitation requires a contributed module or custom code to expose a path; at least one known path needs no login.
- Drupal patched the flaw in 11.4.10, 11.3.19 and 10.6.19. Drupal rates it critical, with a score of 19 out of 25 on its risk scale.
- The vulnerable code executed a callback supplied in a table row's #region_callback property. The fix uses the row's region value instead of calling that callback.
- Sites unable to update can uninstall Field UI temporarily, but its field-management pages will be unavailable. Drupal Steward blocks some known attack paths, but does not cover every possible exploit.
- In the week starting October 4, 151,442 of 531,499 sites reporting their Drupal core version to drupal[.]org were on affected branches that had received no fix.
- As of October 15, no public exploit code or attacks had been reported. Drupal also fixed two moderately critical, logged-in-user XSS flaws in Link and Navigation.
- Entity List separately received a critical RCE advisory, CVE-2026-108099, and version 3.0.10 fixes it; updating Drupal core does not update the module.
Article Details
- Vulnerability Types
- Remote code execution via an unchecked PHP callback in Field UI table rows
- Cross-site scripting in the Link module
- Cross-site scripting in the Navigation module
- Severity
- Critical for CVE-2026-108097 (Drupal risk score 19/25); two additional flaws are rated moderately critical
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Uninstall the Field UI module (field_ui) until the site can be updated; field-management and display pages will be unavailable.
- Drupal Steward blocks some known attack vectors, but does not cover every possible exploit.
CVE
CVE-2026-108097Tracked as CVE-2026-108097, the flaw sits in Field UI, the core module behind the admin pages where site builders manage fields and how they display. Drupal rates it 19 out of 25 on its own risk scale, the level theCVE-2026-108099Separately, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login. Its 3.0.10 release note says the fixCVE-2026-108514The same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.CVE-2026-108515The same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.
People
Products
DrupalDrupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.Drupal StewardDrupal Steward, a web application firewall service with rules written by the Security Team, already blocks some known attack vectors for this flaw. Acquia, Pantheon, Ironstar, and Skpr run it for their customers. ItEntity ListSeparately, the Entity List module received its own critical remote code execution advisory, CVE-2026-108099, with the same conditions, including a known path that needs no login. Its 3.0.10 release note says the fixField UIDrupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.Link moduleThe same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.Navigation moduleThe same core releases also fix two moderately critical cross-site scripting flaws, in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which need at least a logged-in user.