Drupal patches two critical RCE bugs, warns exploits could come fast
Drupal shipped fixes for five vulnerabilities, including two critical remote code execution flaws that need contributed modules to be reachable, and urged admins to make time for core updates.
Drupal has released patches for five vulnerabilities, two of them rated critical and described as potentially exploitable for remote code execution, SecurityWeek reported.
The first critical bug sits in the Entity List module, which lets users build lists of entities without Views. Drupal says the module alone isn't enough to exploit it, but other contributed modules open exploit paths. "At least one known exploit path does not require authentication," Drupal noted, adding that custom code may also expose the vulnerable functionality.
The second affects the Field UI module in Drupal core. Core alone isn't exploitable, according to the advisory, but contributed modules provide serious paths, including at least one needing no authentication. Uninstalling the core Field UI module is offered as a mitigation.
Fixes are in Entity List version 3.0.10 and Drupal versions 11.4.10, 11.3.19 or 10.6.19. Earlier Drupal releases are end-of-life and no longer get security updates.
The same round of updates covers cross-site scripting holes in the core Link module and the Navigation module, plus an XSS defect in the Gin administration theme, fixed in Gin 5.0.16 and 4.1.4.
Drupal did not say any of these were exploited in the wild. It did urge users to reserve time for core updates, warning that "exploits might be developed within hours or days."
What defenders should do
- Inventory sites for Entity List, Field UI, Link, Navigation and Gin, and check which contributed modules are in use, since those determine real exposure.
- Move to the listed fixed versions rather than relying on module removal alone.
- Treat end-of-life Drupal installs as a separate migration problem, since they won't receive these fixes.
- Watch Drupal's security advisories page for updates, given the stated risk of quick exploitation.
CVE references
Sources
- Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw - SecurityWeekPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning