Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal has released security updates addressing a critical vulnerability in its core Field UI module, tracked as CVE-2026-108097, which scores 19 out of 25 on Drupal's own severity scale. While the bug cannot be triggered through core alone, several contributed modules and custom code can expose exploit paths, including at least one that requires no authentication. The issue stems from an unchecked PHP callable executed during the rendering of Field UI's admin tables, bypassing protections Drupal added back in 2019. Site owners should upgrade to Drupal 11.4.10, 11.3.19, or 10.6.19 immediately, or disable the field_ui module as a temporary mitigation; versions 11.2.x and earlier, 10.5.x and earlier, and Drupal 8/9 remain unpatched since they are already end-of-life. A related critical RCE flaw, CVE-2026-108099, was also fixed in the contributed Entity List module, alongside two lower-severity XSS issues (CVE-2026-108515 and CVE-2026-108514) in the Link and Navigation modules.