Preliminary research

CVE-2026-108097: Drupal Field UI callback flaw — conditional lab research pack

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

A conditional Drupal Field UI lab analyzes a callback receiving one row array, enumerates compatible PHP/PEAR gadgets, and chains upload staging, file copy/deletion and .htaccess replacement into execution. A synthetic module supplies the missing contributed-module writer; core alone is not shown exploitable.

Record

Published by

GitHub

Date

18 October 2026

Format

Repository

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Drupal callback gadget analysis
• Drupal RCE capability witness
• Drupal synthetic HTTP witness
• Drupal upload-staged witness
• Drupal conditional lab
• Original advisory
• Companion article

Tags

• drupal
• php
• callback-injection
• gadget-discovery
• file-write
• apache
• htaccess

This page is the archive's own catalogue record. The research is the work of GitHub, first published at the original source. Preserved copies are kept so the citation survives its host.