Drupal has patched a critical remote code execution flaw in its core Field UI module, warning site owners that the danger depends on what else is installed alongside core. The advisory, SA-CORE-2026-014, was published on 14 October 2026 for CVE-2026-108097. Field UI is the core module behind the administrative pages where site builders manage fields and how they display. The flaw arises because Field UI could execute a PHP callback supplied through a table row's region-callback property without validating it. In the right conditions, that can allow an attacker to run code on the website's server.

Why core alone is not the whole story

Drupal is explicit that the flaw is not directly exploitable through Drupal core alone. Several exploit paths exist through contributed modules, and at least one known path does not require authentication. Custom code can also expose the vulnerable function. Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19, with a fix also available for Drupal 12 pre-releases. Older branches, including Drupal 11.2 and earlier, 10.5 and earlier, and Drupal 8 and 9, are end of life and receive no patch; those sites need to upgrade to a supported release.

A public lab proof-of-concept raises urgency

On 18 October, security firm Fortbridge published a technical analysis and lab code that rebuilt the attack chain end to end, from file reading to command execution, on a vulnerable 11.4.9 installation, while the same chain failed on fixed 11.4.10. That lab used a synthetic module to bridge the gap, and no public contributed module has been shown to provide that path, so this is not evidence of confirmed exploitation in the wild. As a temporary mitigation, Drupal says uninstalling the Field UI module protects a site until it can be updated,.