EN PT-BR
← Voltar ao feed
critical government education non-profit

Drupal patches critical RCE flaws CVE-2026-108097 (Field UI) and CVE-2026-108099 (Entity List) plus XSS bugs; no exploitation reported yet

4 fonte(s) · 4 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 1 semana

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 31/10/2026 00:05; os links antigos trazem para cá.

Fontes: cert.ssi.gouv.fr ↗ gbhackers.com ↗ securityweek.com ↗ bleepingcomputer.com ↗

On 14 October 2026 Drupal released security updates, and CERT-FR followed with advisory CERTFR-2026-AVI-1321 on 15 October. The release covers five flaws, including two critical remote code execution (RCE) bugs: CVE-2026-108097 in the Field UI module of Drupal core and CVE-2026-108099 in the contributed Entity List module. Neither is exploitable on its own, but contributed modules or custom code expose them, and at least one path needs no authentication (bleepingcomputer.com, securityweek.com, gbhackers.com). The update also fixes XSS flaws in the core Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514), and in the Gin admin theme. Drupal reports no exploitation in the wild, and gbhackers.com rates the exploit status as theoretical. However, Drupal warned on 12 October that exploits could appear within hours or days of disclosure, so patching should be prioritized (securityweek.com, bleepingcomputer.com).

Entenda a falha

A vulnerabilidade

Two critical RCEs were fixed. CVE-2026-108097 is in the Field UI (field_ui) module of Drupal core. CVE-2026-108099 is in the contributed Entity List module. Neither is exploitable with core or the module alone. Contributed modules or custom code expose the vulnerable functionality, and at least one known path for each needs no authentication. Drupal rates CVE-2026-108097 19/25, with basic complexity and full confidentiality and integrity impact. Fixed in Drupal 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. Drupal 12 pre-releases before beta2 are affected. Also fixed: XSS in the Link (CVE-2026-108515) and Navigation (CVE-2026-108514) modules and in the Gin theme (fixed in 5.0.16 and 4.1.4). CERT-FR lists only 10.6.x, 11.3.x and 11.4.x; gbhackers gives a wider range starting at 8.9.0, but those older branches are end-of-life and get no fix.

Como funciona

The articles do not describe the internal flow, and the advisory deliberately omits the modules involved and the requests that trigger the flaw. What they say is that Field UI in core contains a function that is not reachable through core alone. Contributed modules or custom code can reach it, and in at least one known path an anonymous visitor can do so. At that point the server ends up running attacker-influenced code. Entity List behaves similarly, needing interaction with other contributed modules or custom code. Whether a given site is exposed therefore depends on which modules and custom code are installed.

Por que é vulnerável

The articles do not state the root cause or why the flaws went unnoticed. They only show that the vulnerable functionality is unsafe when other code can reach it, which is why it is not exploitable in core or in Entity List alone. The fix is shipped in the patched core and module releases, and the articles do not detail what it changes. Drupal's stated mitigation for CVE-2026-108097 is to uninstall field_ui; hiding its interface or restricting menu access is not equivalent.

Onde está

The Field UI (field_ui) module in Drupal core and the contributed Entity List module; no file or function is named. CERT-FR cites Drupal bulletins SA-CORE-2026-014, -015 and -016.

Como foi descoberta

According to gbhackers, the CVE-2026-108097 advisory credits Drupal Security Team member Drew Webber and researcher Octavio Galland with reporting it. The articles say nothing about who found CVE-2026-108099 or how. On 12 October Drupal pre-announced the release, warning that exploits might appear within hours or days. The advisories were published on 14 October and CERT-FR followed on 15 October. No article reports exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 00:20.

Detalhes técnicos

  • CVE-2026-108097: RCE in the core Field UI (field_ui) module. Core alone is not exploitable, but several contributed modules provide serious exploit paths, including at least one unauthenticated path. Custom code may also expose the vulnerable function (bleepingcomputer.com, gbhackers.com).
  • gbhackers.com cites a Drupal risk score of 19/25 for CVE-2026-108097, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. It credits Drew Webber (Drupal Security Team) and Octavio Galland with the report.
  • CVE-2026-108099: RCE in Entity List, a contributed module for building entity lists without Views. It needs a similar interaction with other contributed modules or custom code, and at least one known path is unauthenticated (bleepingcomputer.com, securityweek.com).
  • CVE-2026-108515: XSS in the core Link module. CVE-2026-108514: XSS in the core Navigation module (securityweek.com). The Gin theme XSS has no CVE in the source.
  • CERT-FR lists the impact as remote arbitrary code execution and indirect code injection (XSS), referencing vendor bulletins SA-CORE-2026-014, -015 and -016. It does not map each CVE to an impact or state whether authentication is needed (cert.ssi.gouv.fr).
  • The advisory does not name the contributed modules involved, publish an exploit or describe the triggering requests (gbhackers.com). No malware family or threat actor is identified.
  • Drupal 12 pre-releases before 12.0.0-beta2 are also affected, and the stable 12.0 release will include fixes (bleepingcomputer.com, gbhackers.com).
  • Drupal powers over one million sites, popular with government agencies, universities and non-profits (bleepingcomputer.com).

Remediação

  • Update Drupal core to 10.6.19, 11.3.19 or 11.4.10, depending on the branch.
  • Update Entity List to 3.0.10 (bleepingcomputer.com, securityweek.com).
  • Update Gin to 5.0.16 or 4.1.4 (securityweek.com).
  • If an upgrade is not possible, uninstall the core Field UI module as a mitigation for CVE-2026-108097. Hiding its interface or restricting menu access is not equivalent protection (gbhackers.com).
  • Drupal Steward blocks some known attack paths but not all, so subscribers must still upgrade (bleepingcomputer.com, gbhackers.com).
  • Sites on end-of-life branches receive no fixes and should migrate to a supported release.

Relatos divergentes

  • Affected versions: CERT-FR lists 10.6.x before 10.6.19, 11.3.x before 11.3.19 and 11.4.x before 11.4.10 (cert.ssi.gouv.fr). gbhackers.com gives a wider range: 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, 11.4.0 to before 11.4.10, and 12.0.0-alpha1 to before 12.0.0-beta2. The older ranges are end-of-life and unpatched, so they are affected but have no fix.
  • CVE coverage: CERT-FR lists CVE-2026-108097, -108514 and -108515 but not CVE-2026-108099, which is a contributed-module flaw rather than a core one. bleepingcomputer.com covers only the two RCEs, while securityweek.com covers all five fixes and is the most complete.
  • Exploitation status: No source reports in-the-wild exploitation. CERT-FR is silent on the subject, while the other three cite Drupal's warning that exploits may come quickly.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32

    CERT-FR: Multiple Drupal vulnerabilities allow remote code execution and XSS (CVE-2026-108097, -108514, -108515)

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1321, published 15 October 2026, reports multiple vulnerabilities in Drupal core that allow a remote attacker to execute arbitrary code and perform indirect code injection (XSS). The advisory references CVE-2026-108097, CVE-2026-108514 and CVE-2026-108515, based on three Drupal security bulletins dated 14 October 2026 (SA-CORE-2026-014, -015 and -016). It does not state whether any flaw is exploited in the wild, and gives no per-CVE technical detail, CVSS severity, IOCs or attribution.

    Technical Details

    • Affected: Drupal 10.6.x before 10.6.19, 11.3.x before 11.3.19, and 11.4.x before 11.4.10.
    • Impact: remote arbitrary code execution and indirect remote code injection (XSS).
    • Vendor bulletins: SA-CORE-2026-014, SA-CORE-2026-015 and SA-CORE-2026-016.
    • The advisory does not map individual CVEs to specific impacts or state whether authentication is required.

    Remediation

    • Consult the Drupal security bulletins and upgrade to the fixed versions: 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.
  2. gbhackers.com ↗ · pub. 19/10/2026 09:39 · coletado 19/10 17:54

    Drupal discloses critical Field UI RCE flaw CVE-2026-108097 exploitable via contributed modules, including an unauthenticated path

    This article adds detail on CVE-2026-108097 beyond the existing case: the advisory date (October 14, 2026), the 19/25 risk score, the theoretical exploit status, and the credit to Drew Webber and Octavio Galland for reporting the flaw. It also says Drupal Steward only partially mitigates the issue and that Drupal 12 pre-release builds are affected.

    ler a análise desta fonte

    This article adds detail on CVE-2026-108097 beyond the existing case: the advisory date (October 14, 2026), the 19/25 risk score, the theoretical exploit status, and the credit to Drew Webber and Octavio Galland for reporting the flaw. It also says Drupal Steward only partially mitigates the issue and that Drupal 12 pre-release builds are affected.

    Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (field_ui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not directly exploitable, but several contributed modules create serious attack paths, at least one of them unauthenticated, and custom code can also expose the vulnerable function. The exploit status is rated theoretical and no active exploitation is reported. The flaw was reported by Drupal Security Team member Drew Webber and researcher Octavio Galland.

    Technical Details

    • Affected: Drupal 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. Drupal 12.0.0-alpha1 to before 12.0.0-beta2 is also listed.
    • The advisory does not name the contributed modules involved, publish an exploit, or describe the triggering requests.
    • Drupal 10.5.x and earlier, 11.2.x and earlier, and Drupal 8 and 9 no longer receive security coverage.
    • No malware family or threat actor is identified.

    Remediation

    • Update to 10.6.19, 11.3.19 or 11.4.10, depending on the branch in use.
    • As a workaround, uninstall the core Field UI module (field_ui). Hiding its interface or restricting menu access is not equivalent protection.
    • Drupal Steward covers some known attack paths but not all, so subscribers must still upgrade.
    • Migrate sites on end-of-life branches to a supported release.
  3. securityweek.com ↗ · pub. 19/10/2026 12:47 · coletado 19/10 17:53

    Drupal patches five flaws, including critical RCE bugs in Field UI and Entity List; fast exploitation expected

    This article adds three fixes beyond the two RCE flaws already covered: XSS vulnerabilities in the core Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme (fixed in 5.0.16 and 4.1.4). It also states that Drupal reports no in-the-wild exploitation and recalls its October 12 warning that exploits might appear within hours or days.

    ler a análise desta fonte

    This article adds three fixes beyond the two RCE flaws already covered: XSS vulnerabilities in the core Link module (CVE-2026-108515) and Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme (fixed in 5.0.16 and 4.1.4). It also states that Drupal reports no in-the-wild exploitation and recalls its October 12 warning that exploits might appear within hours or days.

    Drupal released patches for five vulnerabilities, including two critical remote code execution flaws: CVE-2026-108099 in the contributed Entity List module and CVE-2026-108097 in the Field UI module of Drupal core. Neither is exploitable on its own, but contributed modules provide exploit paths, and at least one of them requires no authentication. Drupal does not report exploitation in the wild. On October 12, however, it warned that exploits might be developed within hours or days, so defenders should prioritize patching. The update also fixes several cross-site scripting (XSS) bugs in the Link module, the Navigation module and the Gin admin theme.

    Technical Details

    • CVE-2026-108099: RCE in Entity List. It is exploitable only through other contributed modules, and at least one known path is unauthenticated. Custom code may also expose the vulnerable functionality.
    • CVE-2026-108097: RCE in the core Field UI module. Contributed modules provide serious exploit paths, including at least one that needs no authentication.
    • CVE-2026-108515: XSS flaws in the core Link module.
    • CVE-2026-108514: XSS flaw in the core Navigation module.
    • An XSS issue in the Gin administration theme (no CVE given in the article).
    • Previous Drupal releases are end-of-life and receive no security updates.

    Remediation

    • Update Drupal core to 11.4.10, 11.3.19 or 10.6.19.
    • Update Entity List to 3.0.10.
    • Update Gin to 5.0.16 or 4.1.4.
    • As a mitigation for CVE-2026-108097, uninstall the core Field UI module.
    • Migrate sites on end-of-life branches to a supported release.
  4. bleepingcomputer.com ↗ · pub. 17/10/2026 11:32 · coletado 19/10 17:53 primeiro registro

    Drupal patches critical RCE flaws CVE-2026-108097 and CVE-2026-108099 in Field UI and Entity List; exploits expected soon

    ler a análise desta fonte

    Drupal patched two critical remote code execution vulnerabilities affecting all supported versions of Drupal core (Field UI module) and the contributed Entity List module. The Drupal Security Team issued an advance warning, saying exploits could appear within hours or days of disclosure. Both flaws have at least one known exploitation path that requires no authentication when combined with contributed modules or custom code. The article does not report active exploitation. Drupal powers more than one million websites and is popular with government agencies, universities and non-profits.

    Technical Details

    • CVE-2026-108097: RCE in Drupal core's Field UI (field_ui) module. It cannot be exploited with core alone, but contributed modules provide multiple exploitation paths, including at least one that needs no authentication. Custom code may also expose the vulnerable functionality.
    • CVE-2026-108099: RCE in Entity List, a contributed module for creating entity lists without Views. It requires a similar interaction with contributed modules or custom code and has at least one known unauthenticated exploitation path.
    • Drupal 12 pre-releases before beta2 are also affected; the stable 12.0 release will include fixes.
    • Drupal versions before 10.6.x and Drupal 11 versions before 11.3.x are end-of-life and receive no fixes.

    Remediation

    • Update Drupal core to 10.6.19, 11.3.19 or 11.4.10, depending on the release branch.
    • Update Entity List to 3.0.10.
    • If an upgrade is not possible, uninstall the core Field UI (field_ui) module as a mitigation.
    • Drupal Steward blocks some known attack vectors but does not cover every possible exploit.
    • Sites on end-of-life branches should migrate to a supported version.