CVE-2026-108097

Drupal core is vulnerable to Remote Code Execution (RCE) via a Reflection Injection vulnerability in the field_ui module. The root cause is the improper use of externally controlled input in core/modules/field_ui/src/Element/FieldUiTable.php:72, where the #region_callback value from a render arra...