CVE-2026-108097: how a single line in Drupal Field UI turns into code execution
The research examines the critical CVE-2026-108097 vulnerability in the Drupal core's Field UI module, fixed in version 11.4.10. The vulnerable code contains a dangerous function call, but exploiting it requires a module that allows an external user to control the data passed to it. The authors reconstructed the entire exploitation chain in a local lab — from file disclosure to remote command execution.
The vulnerability is located in Field UI, a Drupal core module responsible for administrative field configuration pages. The vulnerable line is in the
FieldUiTable.php file (versions ≤ 11.4.9):php
$region_name = call_user_func_array($row['#region_callback'], [&$row]);```
This code takes the value of the `#region_callback` field and executes it as a PHP callable, passing the table row itself as an argument.
Two halves of the attack
The vulnerability itself is only an execution point — the place where data becomes code. To exploit it, an input source is required: a mechanism that allows an external user to influence the `#region_callback` field in the table row.
• Execution point: Drupal core — the same vulnerable line is present in every stock 11.4.9 installation.
• Input source: a contributed or custom module. The only core `field_ui_table` is on an administrative page that requires privileges to access, and its callback functions are fixed at build time.
Limitation: the vulnerable code is present in every affected installation, but exploitability depends on the module ecosystem
Exploitation chain:
1. Arbitrary callable execution. Setting `#region_callback`, `print_r` causes the website’s response to include a dump of the table row.
2. Sensitive file disclosure. `PEAR System::cat` copies `settings.php` to the public files directory, after which a regular GET request exposes the hash salt and database credentials.
3. Remote code execution. To bypass protection for the `files` directory on an Apache server, the authors replaced `.htaccess` rather than deleting it. The replacement uses `RewriteEngine On` and `php_flag engine on` to override the inherited rewrite rules and re-enable PHP execution. Three operations are performed in a single unauthenticated request: copying an uploaded marker to `x.php`, deleting the existing `.htaccess`, and copying the replacement `.htaccess`.
Article: https://fortbridge.co.uk/research/cve-2026-108097-deep-dive-turning-a-drupal-field-ui-callback-into-rce/Vulnerabilities
Vendors
Products