Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Read original article ↗AI Summary
Drupal has patched a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-108097, in its Field UI module. The flaw allows unauthenticated attackers to execute arbitrary code on affected servers through exploit paths involving contributed modules. While the core vulnerability cannot be exploited directly, at least one known path via contributed modules requires no authentication. The fix was released in multiple supported versions, but older branches including Drupal 8, 9, and earlier end-of-life versions remain unpatched. Additionally, the Entity List module is affected by a similar RCE flaw, CVE-2026-108099, with identical exploitation conditions.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.