Full Report
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Analysis Summary
# Vulnerability: Drupal Core Remote Code Execution (RCE) in Field UI Module
## CVE Details
- **CVE ID**: CVE-2026-108097
- **CVSS Score**: 19/25 (Drupal Risk Scale - Critical)
- **CWE**: CWE-94 (Improper Control of Generation of Code / Code Injection via arbitrary PHP callback)
## Affected Systems
- **Products**: Drupal Core
- **Versions**:
- 11.4.x (prior to 11.4.10)
- 11.3.x (prior to 11.3.19)
- 10.6.x (prior to 10.6.19)
- 12.0.0 (prior to 12.0.0-beta2)
- **Configurations**: Sites with the **Field UI** module enabled (installed by default in the "Standard" profile). Note that while core alone is not directly reachable, the presence of certain contributed modules or custom code can expose the flaw.
## Vulnerability Description
The flaw resides in the Field UI module's handling of admin tables. The module used a `#region_callback` property within render arrays to build administrative tables. During the table element’s pre-render step, the system executed any PHP callable provided in this property via `call_user_func_array` without validating the callback.
While Drupal’s renderer has restricted untrusted callbacks since 2019, this specific pre-render step bypassed those checks because the renderer trusted the parent table element itself, allowing the nested, unvalidated callback to execute arbitrary code.
## Exploitation
- **Status**: No known exploitation in the wild at time of reporting; PoC not publicly available.
- **Complexity**: Medium (Requires specific contributed modules or custom code to expose the pathway).
- **Attack Vector**: Network (Remote). At least one known exploit path via contributed modules requires no authentication (Unauthenticated RCE).
## Impact
- **Confidentiality**: High (Full server/database access possible)
- **Integrity**: High (Execution of arbitrary code)
- **Availability**: High (Potential for complete site takeover or deletion)
## Remediation
### Patches
Update to the following versions immediately:
- **Drupal 11.4**: Update to **11.4.10**
- **Drupal 11.3**: Update to **11.3.19**
- **Drupal 10.6**: Update to **10.6.19**
- **Drupal 12.0**: Update to **12.0.0-beta2**
### Workarounds
- **Uninstall Field UI**: If patching is not immediately possible, uninstalling the `field_ui` module provides protection. Note: This will disable the administrative interface for managing fields and displays.
- **Drupal Steward**: Use the Drupal Steward WAF service, which provides virtual patching for known vectors of this flaw.
## Detection
- **Indicators of Compromise**: Monitor web server logs for suspicious requests to admin paths related to field management (`/admin/structure/types/manage/...`). Look for unexpected PHP functions being called via POST requests.
- **Detection Methods**: Audit custom or contributed modules that interact with `field_ui_table` or set `#region_callback` properties in render arrays.
## References
- **Vendor Advisory**: hxxps[://]www[.]drupal[.]org/sa-core-2026-014
- **PSA**: hxxps[://]www[.]drupal[.]org/psa-2026-10-12
- **Technical Context**: hxxps[://]www[.]drupal[.]org/node/2966725