Loading vulnerability…
CVE-2026-108097 is a critical remote code execution vulnerability in Drupal core's Field UI module. During table pre-render processing, FieldUiTable invokes a row's #region_callback through call_user_func_array without validating the callable, passing the row array as its argument. This nested invocation bypasses Drupal's render-callback trust restrictions. Contributed modules or custom code that allow attacker-controlled values to reach this property can expose arbitrary callable invocation, enabling file disclosure, file modification, and potentially remote code execution. Drupal core alone does not expose the required attacker-controlled input path. Drupal identifies multiple contributed-module exploitation paths, including at least one requiring no authentication, but does not name the modules. Laboratory file disclosure and code execution were demonstrated using a synthetic bridge module rather than a verified, currently exploitable contributed module. Affected supported branches include Drupal 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10; older unsupported branches and Drupal 12 prereleases before beta2 are also affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Standalone synthetic exploit research pack for the repository-identified CVE-2026-108097 / SA-CORE-2026-014. The supplied listing contains 26 files: 16 PHP/Python/Bash source files, six Markdown documents, and four infrastructure/module configuration files. lab/ supplies paired Docker deployments of Drupal 11.4.9 and the stated patched control 11.4.10; lab_bridge/ supplies an intentionally unauthenticated synthetic writer; witnesses/ contains four Python differential suites and four Bash demonstration scripts; gadget-inventory/ contains six class discovery, reflection, dynamic probing, and triage tools. No exploit framework is used. The reported vulnerable sink invokes a row-controlled PHP callable with the entire row array by reference. Direct shell builtins cannot simply receive a command string through this sink because they instead receive an array. The repository demonstrates print_r output, a custom allowlisted command-execution callback, and PEAR System::cat/System::rm file primitives. Its strongest chain copies staged PHP into the public files directory, removes its hardening .htaccess, and replaces it with directives that permit PHP execution in the tested Apache/mod_php posture. The upload variant sources both files from a configured anonymous Webform upload rather than pre-planted container files. Disclosure copies settings.php into a publicly retrievable text file; no external receiver is present. The crucial limitation is explicit: lab_bridge creates the missing request-to-#region_callback trust-boundary crossing. No genuine contributed-module entry point is identified, and default Drupal unauthenticated exploitation is not established. The inventory documents conditional Webform submission/DB-write behavior and other side effects, but does not establish a direct stock one-array-argument command-execution gadget. Documentation also records failed direct read-to-response, environment disclosure, and deletion-only PHP-execution approaches. Operational cautions: early comments claiming no filesystem or shell effects are stale relative to the implemented gadget and execMarkup paths. Loopback isolation comes from Docker port bindings, not a controller-side localhost check. The Bash RCE demonstrations leave target-side hardening changes and payload files unless separately restored; the Python gadget witnesses include restoration logic. The upload script's rm -rf removes its generated local temporary workspace and cookie jar, not evidence of a fake exploit. Several supplied files are truncated, and reported execution results were not independently reproduced. The CVE attribution and version differential are repository claims. Repository URL, git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability involving a Drupal Field UI callback, reported to enable file disclosure and remote code execution in a paired laboratory setup. The contributed-module writer remains unverified; the excerpt does not establish real-world exploitation.
Drupal core’s Field UI table renderer executes a PHP callable specified in a render-array row’s #region_callback. If contributed or custom code allows an attacker to influence that value and row contents, exploitation can enable file disclosure, modification, deletion, and ultimately remote code execution. The researchers demonstrated unauthenticated exploitation against Drupal 11.4.9 using a synthetic bridge module; they did not identify a currently vulnerable real-world module providing the necessary input path. Drupal 11.4.10 removes the callback execution sink. The report gives a conditional CVSS score of 9.8 when an exploitable writer module is present.
A critical remote code execution vulnerability in Drupal core's Field UI module affecting all supported core versions. Drupal core alone does not expose an exploitation path, but contributed modules or custom code can expose the vulnerable functionality, including at least one unauthenticated path. Fixed core releases are 10.6.19, 11.3.19, and 11.4.10. Drupal 12 pre-releases before beta2 are also affected. Uninstalling Field UI is an effective mitigation; Drupal Steward offers only partial protection.
Critical remote code execution vulnerability in Drupal core's Field UI module, rated 19/25 on Drupal's risk scale. Its table pre-render processing executed arbitrary PHP callbacks from row #region_callback properties without checking their trustworthiness. Core alone does not expose an exploitation path, but contributed modules or custom code can; at least one known path requires no authentication. Fixes remove callback execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.