---
title: Drupal SA-CORE-2026-014 (CVE-2026-108097): critical Field UI RCE with unauthenticated contrib paths; Entity List CVE-2026-108099 needs its own update | ctxsec
url: https://ctxsec.com/items/drupal-cve-2026-108097
description: ""
status: "confirmed (vendor); no known exploitation, last updated Oct 19, 2026"
published: 2026-10-14
updated: 2026-10-19
---

> 

[← Cybersecurity News](/news) · [markdown](/items/drupal-cve-2026-108097.md)

confirmed (vendor); no known exploitation

2026-10-14 · updated

Oct 19, 2026

### Drupal SA-CORE-2026-014 (CVE-2026-108097): critical Field UI RCE with unauthenticated contrib paths; Entity List CVE-2026-108099 needs its own update

The Drupal Security Team released SA-CORE-2026-014 on Oct 14 for CVE-2026-108097, a critical remote code execution bug in the core Field UI module (risk 19/25). Core alone is not directly exploitable, but multiple serious paths exist through contributed modules, and at least one known path needs no authentication; custom code can also expose it. Affected: Drupal 8.9+ before 10.6.19, 11.x before 11.3.19 / 11.4.10, and 12.0.0-alpha1 through beta1. Fixed releases: 10.6.19, 11.3.19, 11.4.10 (and Drupal 12 betas per the advisory). Until you update, uninstall the field_ui module. Drupal Steward covers some known vectors but not all. The advisory rates exploitation Theoretical; not on CISA KEV as of catalogVersion 2026.10.14. Same day, SA-CONTRIB-2026-218 (CVE-2026-108099, also critical 19/25) fixed the same kind of RCE in the contributed Entity List module, with at least one unauthenticated path. Updating core doesn't fix it; upgrade Entity List to 3.0.10. **Update Oct 19:** Fortbridge published a lab proof of concept on Oct 18 (GitHub fortbridge/cve-2026-108097-research). It rebuilds the full chain on Drupal 11.4.9 versus 11.4.10: the Field UI sink runs any PHP callable named in a row's `#region_callback`, which leads to `settings.php` disclosure and then code execution by replacing `files/.htaccess`. It uses a _synthetic_ lab module in place of the still-unnamed contrib module that exposes the path, so it isn't a working exploit against real sites. It does mean the core half of the exploit is now public, so patch or uninstall field_ui if you haven't. Still not on CISA KEV.

Sources: [Drupal SA-CORE-2026-014](https://www.drupal.org/sa-core-2026-014) · [PSA-2026-10-12 (upcoming critical)](https://www.drupal.org/psa-2026-10-12) · [Pantheon release note](https://docs.pantheon.io/release-notes/2026/10/drupal-core-security-update) · [Drupal SA-CONTRIB-2026-218 (Entity List)](https://www.drupal.org/sa-contrib-2026-218) · [Fortbridge PoC write-up (Oct 18)](https://fortbridge.co.uk/research/cve-2026-108097-deep-dive-turning-a-drupal-field-ui-callback-into-rce/)