Drupal Core Field UI unauthenticated RCE via unsafe #region_callback PHP callable execution

#!/usr/bin/env bash
# check_cve_2026_108097.sh — Detect CVE-2026-108097 (Drupal Field UI RCE)
# Usage: ./check_cve_2026_108097.sh /path/to/drupal/docroot
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

DOCROOT="${1:-}"
if [ -z "$DOCROOT" ] || [ ! -d "$DOCROOT" ]; then
  echo "UNKNOWN — Usage: $0 /path/to/drupal/docroot"
  exit 2
fi

# Detect Drupal major version and core version
VERSION=""
if [ -f "$DOCROOT/core/lib/Drupal.php" ]; then
  # Drupal 8/9/10/11/12
  VERSION=$(grep -oP "const VERSION = '\K[^']+" "$DOCROOT/core/lib/Drupal.php" 2>/dev/null || true)
elif [ -f "$DOCROOT/includes/bootstrap.inc" ]; then
  # Drupal 7
  VERSION=$(grep -oP "define\('VERSION', '\K[^']+" "$DOCROOT/includes/bootstrap.inc" 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not detect Drupal version at $DOCROOT"
  exit 2
fi

echo "Detected Drupal version: $VERSION"

# Check if field_ui is enabled (Drupal 8+)
FIELD_UI_ENABLED="unknown"
if [ -f "$DOCROOT/sites/default/settings.php" ]; then
  # Check via core.extension.yml if it exists
  EXTENSION_FILE=$(find "$DOCROOT/sites" -path '*/sync/core.extension.yml' -o -path '*/config/core.extension.yml' 2>/dev/null | head -1)
  if [ -n "$EXTENSION_FILE" ] && [ -f "$EXTENSION_FILE" ]; then
    if grep -q 'field_ui:' "$EXTENSION_FILE" 2>/dev/null; then
      FIELD_UI_ENABLED="yes"
    else
      FIELD_UI_ENABLED="no"
    fi
  fi
  # Also check if the module directory exists and is reachable
  if [ -d "$DOCROOT/core/modules/field_ui" ]; then
    if [ "$FIELD_UI_ENABLED" = "unknown" ]; then
      FIELD_UI_ENABLED="module_present_status_unknown"
    fi
  fi
fi

# Version comparison function
version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -1)" = "$2" ]
}

# Determine vulnerability status based on version
VULNERABLE=false
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f1-2)

case "$MAJOR" in
  7)
    if version_gte "$VERSION" "7.107"; then
      VULNERABLE=false
    else
      VULNERABLE=true
    fi
    ;;
  8|9)
    # EOL — no patch available, always vulnerable
    VULNERABLE=true
    echo "WARNING: Drupal $MAJOR.x is end-of-life. No patch available."
    ;;
  10)
    if version_gte "$VERSION" "10.6.19"; then
      VULNERABLE=false
    elif version_gte "$VERSION" "8.9.0"; then
      VULNERABLE=true
    fi
    ;;
  11)
    if echo "$VERSION" | grep -qP '^11\.4\.'; then
      version_gte "$VERSION" "11.4.10" && VULNERABLE=false || VULNERABLE=true
    elif echo "$VERSION" | grep -qP '^11\.[0-3]\.'; then
      version_gte "$VERSION" "11.3.19" && VULNERABLE=false || VULNERABLE=true
    else
      VULNERABLE=true
    fi
    ;;
  12)
    if echo "$VERSION" | grep -q 'alpha\|beta1'; then
      VULNERABLE=true
    else
      VULNERABLE=false
    fi
    ;;
  *)
    echo "UNKNOWN — Unrecognized Drupal major version: $MAJOR"
    exit 2
    ;;
esac

if [ "$VULNERABLE" = true ]; then
  echo "field_ui module status: $FIELD_UI_ENABLED"
  if [ "$FIELD_UI_ENABLED" = "no" ]; then
    echo "PATCHED — Version $VERSION is in the vulnerable range, but field_ui is disabled (workaround active)."
    exit 0
  else
    echo "VULNERABLE — Drupal $VERSION is affected by CVE-2026-108097 (SA-CORE-2026-014)."
    echo "Remediation: Upgrade to 10.6.19 / 11.3.19 / 11.4.10 / 12.0.0-beta2+ or uninstall field_ui."
    exit 1
  fi
else
  echo "PATCHED — Drupal $VERSION is not affected by CVE-2026-108097."
  exit 0
fi