Drupal Fixes Critical Field UI Vulnerability That Could Enable Remote Code Execution

Drupal has released security updates to address a critical vulnerability in its core Field UI module that could allow attackers to execute arbitrary code on a website's server. Tracked as CVE-2026-108097, the flaw was patched on October 14, 2026, in Drupal 11.4.10, 11.3.19, and 10.6.19.

The vulnerability carries a critical rating of 19 out of 25 on Drupal's risk scale. Although the flaw cannot be exploited through Drupal core alone, several contributed modules and custom code can expose potential attack paths. At least one known exploitation path does not require authentication.

Field UI is responsible for providing administrative interfaces that allow site builders to manage fields and configure how content is displayed. The Drupal Security Team has not publicly identified all contributed modules that could expose the vulnerability.

Drew Webber of the Drupal Security Team and Octavio Galland are credited with reporting the issue.

Affected Versions and Security Updates

Drupal recommends upgrading to the appropriate patched release based on the installed branch:

  • Drupal 11.4.x: Upgrade to 11.4.10.
  • Drupal 11.3.x: Upgrade to 11.3.19.
  • Drupal 10.6.x: Upgrade to 10.6.19.
  • Drupal 12.0.0 beta: Version 12.0.0-beta2 includes the fix but is not intended for production environments.

No fixes are available for Drupal 11.2.x and earlier, Drupal 10.5.x and earlier, or Drupal 8 and 9, which have reached end of life.

Security support for the Drupal 11.3.x and 10.6.x branches is scheduled to end in December 2026, making timely upgrades particularly important for organizations running those versions.

Workarounds and Exposure Risks

Organizations unable to install the updates immediately can uninstall the Field UI module, identified as field_ui, to protect against the vulnerability while preparing an upgrade. However, removing the module disables the administrative pages used to manage fields and their display settings.

Field UI is included in Drupal's Standard installation profile, meaning websites created with that profile typically have the module enabled unless it has been removed.

Drupal Steward, a web application firewall service that uses security rules developed by the Drupal Security Team, already blocks some known attack vectors associated with the vulnerability. Acquia, Pantheon, Ironstar, and Skpr offer the service to their customers.

However, the protection does not cover every possible exploitation path. Websites using Drupal Steward must still apply the relevant security updates.

The scale of potential exposure is also a concern. During the week beginning October 4, 2026, 151,442 of the 531,499 websites reporting their Drupal core versions to Drupal.org, approximately 28.5%, were running branches listed as affected that did not receive a fix.

As of October 15, no public exploit code or confirmed attacks involving this vulnerability had been reported. Nevertheless, the Drupal Security Team had issued a pre-announcement on October 12, advising administrators to reserve time for the updates because exploits could emerge within hours or days.

How the Vulnerability Works

The vulnerability originates in the way Field UI processes administrative tables using Drupal render arrays, which are PHP arrays that the framework converts into HTML.

Before the fix, the table element's pre-render operation executed PHP callables specified in a table row's #region_callback property using call_user_func_array, without validating the callable.

Drupal's renderer has restricted the execution of untrusted render callbacks since version 8.8, released in 2019. However, the table element's own pre-render method was trusted, allowing it to execute the callback internally without triggering the renderer's existing security check.

The October 14 patch removes this callback execution. The updated implementation determines each row's region from its own region value. If the value does not correspond to a recognized region, Drupal uses the table's hidden region or its first available region.

The vulnerable callback mechanism had existed in the code since at least Drupal 8.9.0 in 2020.

In Drupal core, the callback was used only by Field UI's own display forms. However, custom implementations that set #region_callback on a field_ui_table row may behave differently after upgrading because those callbacks will no longer execute. Developers should test their custom code and verify that the field management and display configuration pages continue to function correctly.

Separate Critical Vulnerability in Entity List

Administrators should also check whether their websites use the contributed Entity List module, which received a separate critical remote code execution advisory on October 14.

Tracked as CVE-2026-108099, the vulnerability has similar exploitation conditions, including a known path that does not require authentication. Entity List version 3.0.10 contains the fix, which mirrors the change made to Drupal's Field UI implementation.

Updating Drupal core does not automatically update Entity List, so administrators must upgrade the contributed module separately if it is installed.

During the week beginning October 4, 2026, 90 websites reported using Entity List.

Additional Cross-Site Scripting Vulnerabilities Fixed

The same Drupal core releases also address two moderately critical cross-site scripting vulnerabilities:

  • CVE-2026-108515: A vulnerability affecting the Link module.
  • CVE-2026-108514: A vulnerability affecting the Navigation module.

Both issues require at least an authenticated user, according to their respective advisories.

Drupal 7 reached end of life on Drupal.org in January 2025. However, Pantheon reported that its Drupal 7 long-term support offering, delivered with Tag1 Consulting, has released Drupal 7.107 with a backported fix for the Field UI vulnerability.

Organizations should identify their installed Drupal core versions and update to the appropriate patched release as soon as possible. Administrators should also check for the Entity List module, upgrade it independently if present, and review custom code that relies on #region_callback.

Where immediate patching is not possible, uninstalling Field UI can provide temporary protection, although it removes the associated administrative functionality. Web application firewall protections may block some known attack paths but should not replace software updates.

With the Drupal Security Team warning that exploit code could emerge quickly, administrators should prioritize remediation and verify their applications after deployment.