Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal has shipped fixes for a critical flaw in its core Field UI module (CVE-2026-108097) that could let an attacker run code on a site’s server, The Hacker News reports. The flaw cannot be reached through core alone, but several exploit paths exist through contributed modules, at least one requiring no login; fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19.