# CVE-2026-108097: Drupal Core remote code execution in Field UI module

Source: https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108097 · Severity: info · Published 2026-10-30

Drupal Core, a popular content management system, contains a remote code execution vulnerability in its Field UI module. While the vulnerability cannot be exploited through Drupal Core alone, it can be exploited when combined with contributed modules or custom code, with at least one known attack path requiring no authentication. Successful exploitation could allow attackers to execute arbitrary code on affected websites.

Technologies: [Drupal Core](https://junglewise.ai/threats/technologies/core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-108097 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108097 being exploited in the wild.

**How severe is CVE-2026-108097?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Drupal Core 8.9.0 to 10.6.18, 11.0.0 to 11.3.18, 11.4.0 to 11.4.9, 12.0.0-alpha1 to 12.0.0-beta1; drupal/core (Packagist) ECOSYSTEM:introduced=8.9.0,fixed=10.6.19|ECOSYSTEM:introduced=11.0.0,fixed=11.3.19|ECOSYSTEM:introduced=11.4.0,fixed=11.4.10|ECOSYSTEM:introduced=12.0.0-alpha1,fixed=12.0.0-beta2.

**Is there a fix for CVE-2026-108097?** Yes. drupal/core (Packagist): upgrade to 10.6.19 or later. Until then: Uninstall the core Field UI module (field_ui) to mitigate the vulnerability while awaiting updates. Alternatively, sites using Drupal Steward are protected from some known attack vectors, though not all possible exploits. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108097 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108097?** Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.6.19 or later

  ```sh
  composer require drupal/core:^10.6.19
  ```


Uninstall the core Field UI module (field_ui) to mitigate the vulnerability while awaiting updates. Alternatively, sites using Drupal Steward are protected from some known attack vectors, though not all possible exploits.

## Technical details

The vulnerability exists in Drupal Core's Field UI module and is not directly exploitable in isolation, but multiple serious attack paths exist when combined with contributed modules or custom code. At least one documented exploit path does not require authentication, making it accessible to unauthenticated attackers over the network. The flaw allows for remote code execution, potentially granting complete control over affected installations.

## Affected products

- Drupal Core 8.9.0 to 10.6.18, 11.0.0 to 11.3.18, 11.4.0 to 11.4.9, 12.0.0-alpha1 to 12.0.0-beta1

## Identifiers

- CVE-2026-108097
- DRUPAL-CORE-2026-014

## Timeline

- 2026-10-14: disclosed

## References

- [https://www.drupal.org/u/mcdruid](https://www.drupal.org/u/mcdruid)
- [https://www.drupal.org/u/ogalland-tob](https://www.drupal.org/u/ogalland-tob)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)
- [Drupal core cross-site scripting in HTMX attribute sanitization](https://junglewise.ai/threats/cve-2026-15917-drupal-core-cross-site-scripting-in-htmx-attribute-sanitization)