Drupal patches two critical RCE flaws and XSS bugs
Original title: Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
Drupal patched five vulnerabilities, including two critical remote code execution bugs. CVE-2026-108099 in Entity List and CVE-2026-108097 in Field UI are not exploitable by those components alone, but contributed modules create paths, including at least one unauthenticated path for each. The updates also fix cross-site scripting in the Link and Navigation modules and in the Gin administration theme. Drupal has not reported exploitation, although on October 12 it warned that exploits might appear within hours or days.
Unconfirmed: Drupal does not say whether any of the five flaws are being exploited.
- Entity List should be updated to version 3.0.10.
- Supported core fixes are Drupal 11.4.10, 11.3.19 and 10.6.19.
- End-of-life Drupal releases no longer receive security updates.
- Gin XSS fixes are in versions 5.0.16 and 4.1.4.
- Link XSS is CVE-2026-108515 and Navigation XSS is CVE-2026-108514.
Impact: Unauthenticated remote code execution or cross-site scripting
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Entity List | — | 3.0.10 |
| Drupal | — | 11.4.10, 11.3.19, or 10.6.19 |
| Gin | — | 5.0.16 and 4.1.4 |
- 1.Update Entity List to 3.0.10
- 2.Update Drupal to 11.4.10, 11.3.19, or 10.6.19
- 3.Uninstall the core Field UI module as a mitigation
- Vendors
- Drupal
- Products
- Entity ListField UIGin
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — | ||
| CVE-2026-108514 | — | — | — | ||
| CVE-2026-108515 | — | — | — |
From the original article
1 min read at securityweek.com
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules. The post Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.