{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014) · updates",
  "home_page_url": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097",
  "feed_url": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/feed.json",
  "description": "A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.",
  "language": "en",
  "_pwn": {
    "slug": "drupal-core-field-ui-rce-cve-2026-108097",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/feed.xml",
    "llms": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097/llms.txt",
    "json": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097#2026-10-14-c10c55c6",
      "url": "https://pwn.watch/i/drupal-core-field-ui-rce-cve-2026-108097#2026-10-14-c10c55c6",
      "title": "Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014): Drupal Security Team publishes SA-CORE-2026-014: Critical RCE in the core Field UI module, fixed in 10.6.19, 11.3.19 and 11.4.10; uninstalling field_ui mitigates.",
      "content_text": "Drupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014): Drupal Security Team publishes SA-CORE-2026-014: Critical RCE in the core Field UI module, fixed in 10.6.19, 11.3.19 and 11.4.10; uninstalling field_ui mitigates.\n\nSource: https://www.drupal.org/sa-core-2026-014",
      "date_published": "2026-10-14T00:00:00.000Z",
      "external_url": "https://www.drupal.org/sa-core-2026-014",
      "tags": [
        "critical"
      ]
    }
  ]
}