vulnerability
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Medium
Summary
The vulnerability stems from a flaw in how the module renders tables, and a fix was released on October 14th for Drupal 11.4.x, 11.3.x, and 10.6.x. The advisory notes that a significant number of sites using affected versions haven't yet been updated, and recommends uninstalling the Field UI module as a temporary mitigation. Additionally, a separate RCE vulnerability exists in the Entity List module, and two other cross-site scripting flaws have been addressed in Drupal 11.4.x, 11.3.x, and 10.6.x.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data