← 返回速览 继续信流 搜索
Aggregate Drupal.org Planet Drupal 15 Oct 2026 - 03:05

Security advisories: Drupal core - Critical - Remote code execution - SA-CORE-2026-014

RSS 官方收录 · 可信分层展示

关键摘要

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.…

  • 19 || >= 11.
  • 10 || >= 12.
  • 0-alpha1 < 12.

规则摘要 · 来源可核验

正文提要

Project: 
Drupal core
Project machine name: 
drupal
Date: 
2026-October-14
Security risk: 
Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default
Vulnerability: 
Remote code execution
Affected versions: 
>= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2
CVE IDs: 
CVE-2026-108097
Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

  • If you use Drupal 11.4.x, update to Drupal 11.4.10.
  • If you use Drupal 11.3.x, update to Drupal 11.3.19.
  • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

  • If you use Drupal 10.6.x, update to Drupal 10.6.19.
  • Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Release packaging may still be in progress for this security announcement. If you are unable to access a release, wait 30-45 minutes and then check again.

Reported By: 
Fixed By: 
Coordinated By: 
打开官方原文 站点原文页 可信分区 本信源更多 今日简报 分享图 RSS 稍后再看列表

相关短闻（同信源优先）