Drupal has released important updates to address five security vulnerabilities, including two critical ones that pose a risk of remote code execution (RCE). These flaws could potentially allow attackers to exploit systems running on the Drupal platform.
Critical Vulnerabilities in Drupal Modules
The first critical flaw is found in the Entity List module. This module enables users to compile lists of entities without using Views. Identified as CVE-2026-108099, this vulnerability is not inherently exploitable on its own but can be leveraged through other contributed modules. Notably, Drupal has identified at least one exploitation path that does not require user authentication, and custom code might further expose this vulnerability.
The second critical issue affects the Field UI module within Drupal core, tracked as CVE-2026-108097. While Drupal core itself is not vulnerable, contributed modules present serious paths for exploitation, including at least one that bypasses authentication. Users are advised to uninstall the core Field UI module as a precautionary measure.
Recommended Security Updates
To mitigate these vulnerabilities, Drupal users should update to Entity List version 3.0.10 and upgrade to Drupal versions 11.4.10, 11.3.19, or 10.6.19. Versions prior to these have reached the end of their lifecycle and no longer receive security patches. This update also addresses cross-site scripting (XSS) vulnerabilities in the Drupal core Link and Navigation modules, tracked as CVE-2026-108515 and CVE-2026-108514, respectively.
Additionally, a security flaw in the Gin administration theme, which could result in XSS attacks, has been patched in Gin versions 5.0.16 and 4.1.4. These updates are crucial for maintaining the security posture of Drupal websites.
Immediate Action Required
At present, there is no indication that these vulnerabilities have been exploited in the wild. However, Drupal has emphasized the urgency of implementing core updates, warning that exploitation could occur within hours or days of the disclosure. Users are strongly encouraged to check Drupal’s security advisories page for detailed guidance and to ensure their systems are protected against potential threats.
The rapid release of these patches underscores the importance of staying vigilant and proactive in cybersecurity measures. Drupal’s prompt action highlights the ongoing commitment to safeguarding its users from emerging threats in the digital landscape.
