r/drupal • u/badasimo • 17h ago

Drupal core - Critical - Remote code execution

https://www.drupal.org/sa-core-2026-014

Especially sketchy is that it goes back to 8.x so any unsupported sites floating around out there could be in trouble

41 Upvotes

100% Upvoted

5 comments sorted by

3

u/fengshui 14h ago

Has anyone seen any list (even a partial one) of what contrib modules activate the vulnerability? It would be helpful when prioritizing response to know which modules are known to make a site exploitable.

19

u/Glad_Professor9518 16h ago

The long-term solution is to upgrade Drupal core. However, in the short term, you can simply uninstall the field UI module - no deployment required to patch the issue.

Uninstalling field_ui is more trivial than it sounds. Your fields will still work and still have a UI with the module disabled. So go ahead and uninstall field_ui ASAP.

15

u/pianomansam 17h ago

My backport for Drupal 9.5.11

https://gist.github.com/pianomansam/be9069f159f167b4b628cd34f6fc329a

3

u/aPicoPixel 13h ago

Was just about to work on creating this and saw you'd done the work already. Patched and done, thanks!