Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal has patched a critical vulnerability in its core that could allow an attacker to execute code on a site's server. The flaw is located in the Field UI module. Fixes for the issue were released in recent versions of Drupal, including 11.4.10, 11.3.19, and 10.6.19. The vulnerability cannot be exploited through the core alone, but can be reached through certain contributed modules. At least one known exploit path does not require a login to access the vulnerability.