Drupal has addressed a critical security flaw in its Field UI module, which could allow attackers to execute remote code on a server. The vulnerability, identified as CVE-2026-108097, has been patched in Drupal versions 11.4.10, 11.3.19, and 10.6.19 released on October 14. This flaw is not directly accessible through Drupal core, but can be exploited via contributed modules, with at least one known method requiring no authentication. Although the advisory does not specify the contributing modules, custom code may also be vulnerable. The flaw, rated 19 out of 25 on Drupal's risk scale, is considered critical.
This vulnerability impacts admin pages where site builders manage fields and their display. The Field UI module, installed by default through Drupal's Standard install profile, must be uninstalled to protect sites that cannot immediately update. This action will temporarily disable admin pages for managing fields. Affected sites must update to the latest Drupal versions to mitigate the risk, as security coverage for versions 11.3.x and 10.6.x ends in December 2026.
Drupal Steward, a web application firewall service, provides some protection against known attack vectors for this flaw, though it does not cover all possible exploits. Thus, updating remains essential. As of October 15, no exploit code had been publicly released, and no attacks had been reported. Previously, Drupal saw exploit attempts within two days of an advisory for a different vulnerability.
The flaw arises from the way Field UI builds admin tables using PHP arrays. Before the fix, the pre-render step ran PHP callables without verifying them, allowing potential unauthorized code execution. The new update prevents this by directly reading each row's region value. Additionally, the Entity List module received a similar advisory, CVE-2026-108099, with a fix that mirrors the Field UI solution. Updating Drupal core does not automatically update this module.
The same updates also address two moderately critical cross-site scripting vulnerabilities in the Link and Navigation modules, both requiring at least a logged-in user. Although Drupal 7 reached its end of life on drupal.org in January 2025, Pantheon's long-term support has released a backport of the fix in Drupal 7.107.
