Drupal Patches Critical Field UI RCE Flaw Reachable Through Contributed Modules

Drupal released security updates for CVE-2026-108097, a critical remote code execution vulnerability in its core Field UI module, under advisory SA-CORE-2026-014. The flaw involves unchecked PHP callbacks during Field UI table rendering. Drupal core alone does not expose an exploitation path, but contributed modules—and potentially custom code—can make the vulnerability reachable, with at least one known path requiring no authentication. As of October 15, reporting identified no public exploit code or publicly described attacks exploiting the flaw.

The Canadian Centre for Cyber Security reinforced the update guidance in bulletin AV26-1047, identifying affected releases before 11.4.10, 11.3.19, and 10.6.19 in their respective branches. Administrators should upgrade to the appropriate fixed release; sites unable to patch immediately can temporarily protect themselves by uninstalling Field UI. A separate, similar vulnerability in the contributed Entity List module requires its own update, so patching Drupal core alone does not address that issue.