cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Drupal Patches Two Critical Core Flaws With Potential Unauthenticated RCE Paths

· Original article ↗

Summary

Drupal patched five vulnerabilities, including two critical flaws with potential unauthenticated RCE paths through contributed modules. No in-the-wild exploitation was reported; users should update affected Drupal and module versions.

Key points

  • CVE-2026-108099 affects the Entity List module; exploit paths may exist through contributed modules, including one that does not require authentication.
  • CVE-2026-108097 affects Drupal core's Field UI module; contributed modules can provide serious exploit paths, including an unauthenticated path.
  • Drupal recommends Entity List 3.0.10 and Drupal 11.4.10, 11.3.19, or 10.6.19. Field UI can be uninstalled as a mitigation.
  • The updates also fix XSS vulnerabilities in the core Link and Navigation modules and the Gin administration theme.
  • Drupal did not report in-the-wild exploitation. It had warned users that exploits might be developed within hours or days.

Article Details

Vulnerability Types
  • Remote code execution (RCE)
  • Cross-site scripting (XSS)
Severity
Critical for CVE-2026-108099 and CVE-2026-108097; severity not stated for the XSS vulnerabilities.
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Uninstall the Drupal core Field UI module to mitigate CVE-2026-108097.

CVE

CVE-2026-108097The second impacts the Field UI module in Drupal core and is tracked as CVE-2026-108097.CVE-2026-108099The first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099.CVE-2026-108514The fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).CVE-2026-108515The fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).

Vendors

DrupalDrupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE).

Products

DrupalDrupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE).Entity ListThe first resides in the Entity List module, which allows users to create lists of entities without Views, and is tracked as CVE-2026-108099.Field UIThe second impacts the Field UI module in Drupal core and is tracked as CVE-2026-108097.GinAdditionally, Drupal announced patches for a security defect in the administration theme Gin that could lead to XSS attacks.Link moduleThe fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).Navigation moduleThe fresh Drupal updates also resolve cross-site scripting (XSS) holes in the Drupal core Link module (collectively tracked as CVE-2026-108515) and an XSS flaw in the Navigation module (CVE-2026-108514).

Related Articles