Skip to content
Hacker Posts

Drupal patches critical Field UI RCE reachable via modules

Drupal core flaw CVE-2026-108097 (SA-CORE-2026-014, 19/25) runs arbitrary PHP via an unchecked #region_callback in Field UI; contributed modules expose an unauthenticated RCE path.

Published 3 min read
cvedrupalphpadvisory

Drupal patched a critical remote-code-execution flaw in its core Field UI module on October 14. SA-CORE-2026-014 (CVE-2026-108097) scores 19 of 25 on Drupal's own scale. The flaw is not reachable through core alone, but Drupal says several contributed-module paths exist and at least one needs no authentication. Fixes are in 11.4.10, 11.3.19 and 10.6.19.

What the bug does

Field UI builds admin tables from render arrays. Before the fix, the table's pre-render step ran any PHP callable placed in a row's #region_callback property via call_user_func_array, with no check on what the callable was. The flaw has sat in core since Drupal 8.9.0 (2020) — Drupal's renderer stopped running untrusted render callbacks in 8.8, but this call path slipped past that hardening.

Affected and fixed versions

  • Affected: 8.9.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2.
  • Fixed: 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 (not for production).
  • Drupal 11.2.x and earlier, and 10.5.x and earlier, are end-of-life and get no fix. 11.3.x and 10.6.x lose security coverage in December 2026.

A related contributed module, Entity List (CVE-2026-108099, SA-CONTRIB-2026-218), is a critical RCE with a known no-login path, fixed in 3.0.10 — updating core does not update it. Two moderately critical XSS bugs (CVE-2026-108515, CVE-2026-108514) ship fixes in the same core releases.

Exploitation status

No public exploit code at publication, and none had surfaced as of October 15; neither Drupal nor public reporting describes attacks. Drupal pre-announced the release as PSA-2026-10-12 on October 12. In the week of October 4, Drupal counted 151,442 of 531,499 reporting sites (28.5%) on an affected branch with no fix available.

Action checklist

  1. Update core to 11.4.10, 11.3.19 or 10.6.19 now.
  2. If you run the Entity List module, update it to 3.0.10 separately — the core update does not cover it.
  3. If you can't update yet, uninstall the field_ui module as interim mitigation. Manage-fields and manage-display pages go away while it's uninstalled; Drupal Steward WAF blocks some known vectors but not all.
  4. On EOL branches (≤11.2, ≤10.5), there is no patch — plan the upgrade now, because exploit paths run through common contributed modules.

Context

This is the second critical core RCE-class flaw on Drupal this year: the May 2026 PostgreSQL SQL injection was exploited within two days of its advisory. The pattern here is familiar — a long-dormant callback-execution path, invisible until someone maps which contributed modules reach it. With 28.5% of reporting sites unpatched, the window for a working contrib-module chain to appear is the thing to watch.

Related stories