Vulnerabilities · Application Security
Drupal fixes critical flaw that could let attackers run code on servers
Drupal has patched a critical vulnerability in its Field UI module that could let attackers run code on affected sites. Some exploit paths need no login. Site owners are urged to update or disable the module.
Ross GrantUpdated 3 min read
The short version
Drupal, a website platform, has fixed a serious security flaw in its Field UI module. This bug could let attackers run code on a site’s server if certain add-ons are installed. Some attack paths do not need a login. Site owners should update Drupal or disable the Field UI module right away.
By the numbers
- 28.5%of reporting Drupal sites on affected branches with no fixThe Hacker News
- 531,499Drupal sites reporting their core version to drupal.orgThe Hacker News
- 151,442sites on affected branches that did not get a fixThe Hacker News
What happened?
Drupal has patched a critical vulnerability in its Field UI module that could allow attackers to run code on affected servers. The flaw can be exploited through certain contributed modules, with at least one attack path requiring no login. Fixes were released on 14 October 2026 for supported versions.
What is the Field UI flaw?
Drupal, a popular content management system, has patched a critical vulnerability in its Field UI module. This flaw could let attackers run code on the server that hosts a Drupal site. The issue is tracked as CVE-2026-108097 and was rated 19 out of 25 on Drupal’s risk scale, which they call critical. The Field UI module is part of the admin interface where site builders manage fields and how they display.
Who is affected and what should they do?
The vulnerability cannot be exploited through Drupal core alone. However, several contributed modules (add-ons made by the community) open up paths to exploit it. At least one of these paths does not require the attacker to log in. The advisory did not name which contributed modules are affected, and custom code could also expose the flaw. The fix was released on 14 October 2026 for Drupal versions 11.4.10, 11.3.19, and 10.6.19. Older versions, including Drupal 8 and 9, are no longer supported and did not receive a fix.
According to Drupal’s advisory (as reported by The Hacker News (opens in a new tab)), about 28.5% of reporting sites were on a branch that is affected and did not get a fix. If a site cannot update right away, uninstalling the Field UI module will block the flaw, but this also removes the admin pages for managing fields.
How does the attack work?
The flaw is in how Field UI builds admin tables from PHP arrays called render arrays. Before the fix, the code would run any PHP function listed in a certain property (#region_callback) for each table row, without checking what that function was. This could let an attacker get the server to run code of their choice if they could set that property, which is possible through some contributed modules or custom code. The patched version no longer calls the callback and instead reads the region value directly.
What about exploit code and real-world attacks?
As of 15 October, there was no public exploit code and no reports of attacks using this flaw. However, Drupal’s Security Team warned that exploits could appear within hours or days, based on past experience. In May, exploit attempts appeared within two days for a different Drupal flaw. The advisory recommends updating as soon as possible.
What about other modules and defences?
A separate module, Entity List, received its own critical remote code execution advisory (CVE-2026-108099) with similar conditions. Its fix mirrors the Field UI change. Drupal Steward, a web application firewall service, blocks some known attack paths for this flaw, but not all. Sites using this service should still update. Two other moderately critical flaws (cross-site scripting in Link and Navigation modules) were also fixed in the same release.
What should site owners do now?
Site owners should update to the latest supported version as soon as possible. If that is not possible, uninstalling the Field UI module will protect the site, but will remove some admin features. Anyone with custom code that uses the #region_callback property should check and test their code after updating. Sites using contributed modules should watch for updates to those modules as well.
What is not yet clear?
The advisory did not name the specific contributed modules that expose the flaw. There is only one public report so far, and no confirmation from Drupal or a government agency. There are no reports of real-world attacks yet.
Claimed vs confirmed
- Confirmed
The flaw can be exploited without login through at least one contributed module.
Drupal Security Team advisory, as reported by The Hacker News, states at least one known exploit path needs no login.
- Confirmed
No public exploit code or real-world attacks have been reported as of 15 October 2026.
The Hacker News reports the advisory rated the flaw as having no public exploit code or attacks at publication.
The impact
- Money
- If attackers exploit this flaw, affected businesses could face costs from incident response, downtime, or regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global annual turnover.
- Reputation
- A compromise could damage trust in sites using Drupal, especially if sensitive data is exposed. Drupal is widely used by governments and businesses, so public breaches could attract attention.
- Customers
- If a site is compromised, attackers could steal data or disrupt services. Site owners should update Drupal or uninstall the Field UI module to protect users.
Why it matters
This flaw could let attackers take control of Drupal sites, risking data and business operations. Many sites use Drupal, including government and business websites. Site owners who do not update or disable the module remain at risk, especially if they use affected add-ons.
How does it work?
The flaw is in the Field UI module's handling of render arrays. Before the fix, the code would run any PHP function listed in a table row's #region_callback property without checking what it was. This could let an attacker execute code if they could set that property, which is possible through some contributed modules or custom code. The patch stops this by no longer calling the callback.
Key points
- Drupal patched a critical flaw in its Field UI module that could let attackers run code.
- Some attack paths need no login and work through contributed modules or custom code.
- About 28.5% of reporting sites are on affected branches that did not get a fix.
- No public exploit code or real-world attacks have been reported yet.
- Site owners should update or uninstall the Field UI module as soon as possible.
Sources
The Hacker News
Reference
