Ethical Hacking News
A critical vulnerability has been discovered in the Field UI module of Drupal, allowing an attacker to execute code on a site's server without authentication. The vulnerability, identified as CVE-2026-108097, has been patched with the release of Drupal 11.4.10, 11.3.19, and 10.6.19, and the Drupal Security Team has provided guidance to affected sites on how to address the issue. Update to the latest supported branch to ensure the security of your site.
The Drupal community has been notified of a critical vulnerability in the Field UI module.The vulnerability, CVE-2026-108097, has been rated 19 out of 25 on the Drupal Security Team's risk scale, indicating a critical flaw.The vulnerability allows an attacker to execute code on a site's server without authentication.The vulnerability was patched with the release of Drupal 11.4.10, 11.3.19, and 10.6.19.The patched release includes a change that prevents the table element's pre-render step from running arbitrary code.The same advisory also fixes two moderately critical cross-site scripting flaws in the Link and Navigation modules.The Drupal 7 branch is not affected by the fixes, as it is no longer receiving updates.The Drupal Security Team recommends updating to the latest supported branch (Drupal 11.4.x, 11.3.x, or 10.6.x) or uninstalling the Field UI module for protection.
The Drupal community has been notified of a critical vulnerability in the Field UI module, which could allow an attacker to execute code on a site's server without authentication. The vulnerability, identified as CVE-2026-108097, has been rated 19 out of 25 on the Drupal Security Team's risk scale, indicating that it is a critical flaw that requires immediate attention.
According to the Drupal Security Team, the vulnerability is located in the Field UI module, which is responsible for managing fields and their display on the site. The module builds its admin tables from render arrays, which are PHP arrays that are turned into HTML by the Drupal renderer. Before the fix, the table element's pre-render step ran whatever PHP callable each table row carried in its region_callback property, through call_user_func_array, with no check on what that callable was.
However, with the release of Drupal 11.4.10, 11.3.19, and 10.6.19, the vulnerability has been patched. The fixed release includes a change in the 11.4.10 code that no longer calls the callback, instead reading each row's region from the row's own region value and using the table's hidden region, or its first region, when that value is not a known region.
In addition to the Field UI module, the same advisory also fixes two moderately critical cross-site scripting flaws in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), both of which require at least a logged-in user. These flaws are also being addressed with the release of Drupal 11.4.10, 11.3.19, and 10.6.19.
It is worth noting that the Drupal 7 branch, which reached end of life on January 2025, is also not affected by the fixes, as it is no longer receiving updates.
The Drupal Security Team has provided guidance to affected sites, recommending that they update to the latest supported branch, which is Drupal 11.4.x, 11.3.x, or 10.6.x. For sites that cannot update yet, the advisory suggests uninstalling the Field UI module, which will provide protection while sites are updated.
Furthermore, the advisory states that Drupal Steward, a web application firewall service with rules written by the Security Team, already blocks some known attack vectors for this flaw, but it does not cover every possible exploit. As such, sites should still update to the latest version.
The advisory also notes that there have been reports of exploit attempts within two days of its advisory for a core SQL injection flaw that affected only sites on PostgreSQL. However, at this time, there is no publicly available exploit code for the current vulnerability, and neither the advisory nor public reports have described attacks using it.
In conclusion, the Drupal community has been notified of a critical vulnerability in the Field UI module that could allow an attacker to execute code on a site's server without authentication. The vulnerability has been patched with the release of Drupal 11.4.10, 11.3.19, and 10.6.19, and the Drupal Security Team has provided guidance to affected sites on how to address the issue.
Related Information:
https://www.ethicalhackingnews.com/articles/Drupal-Patches-Critical-Field-UI-Flaw-With-Unauthenticated-RCE-Path-via-Contributed-Modules-Offers-Security-Guidance-to-Affected-Sites-ehn.shtml
https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html
https://nvd.nist.gov/vuln/detail/CVE-2026-108097
https://www.cvedetails.com/cve/CVE-2026-108097/
https://nvd.nist.gov/vuln/detail/CVE-2026-108514
https://www.cvedetails.com/cve/CVE-2026-108514/
https://nvd.nist.gov/vuln/detail/CVE-2026-108515
https://www.cvedetails.com/cve/CVE-2026-108515/
Published: Thu Oct 15 10:27:18 2026 by llama3.2 3B Q4_K_M
