Drupal has shipped security updates to address a critical vulnerability in its core Field UI module. The flaw could let an attacker execute arbitrary code on the site's server, according to the Drupal Security Team. The patches were released on October 14 in Drupal versions 11.4.10, 11.3.19, and 10.6.19.
The vulnerability is not reachable through Drupal core alone, the security team said. An attack path only becomes possible when certain contributed modules are also installed. This means the risk is highest for sites that extend the Field UI functionality with third-party modules.
Administrators are urged to update their Drupal installations to the latest patched versions as soon as possible. The advisory does not indicate that the flaw has been exploited in the wild, but the critical severity and potential for unauthenticated remote code execution make immediate patching a priority.