CVE-2026-56382Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

CVE Official@CVE2026COIN91d
Disclosure
🟠 HIGH (CVSS 7.2) — CVE-2026-56382 Published: 2026-06-21 Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14. 🧬 CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 🔗 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56382 📚 References: • https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467 • https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller #CVE #CyberSecurity #InfoSec #Vulnerability
Post summary
The advisory announces a remote code execution flaw in Craft CMS’s FieldsController, detailing its CVSS, affected versions, and a fix (v5.9.14) without reporting active exploitation or PoC.
30030260
21 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨High - Craft CMS Authenticated RCE via Missing Config Sanitization (CVE-2026-56382) Craft CMS's FieldsController::actionRenderCardPreview() method passes the fieldLayoutConfig POST parameter straight to Fields::createLayout() without calling Component::cleanseConfig(). Because the config isn't sanitized, an authenticated admin user can inject Yii2 event handlers such as 'on init' keys through fieldLayoutConfig. This allows execution of arbitrary PHP code and disclosure of sensitive data, including environment variables holding database credentials and the CRAFT_SECURITY_KEY. Exploitation requires an admin-level account but no user interaction. 👉Upgrade to Craft CMS 5.9.14.
Post summary
The text announces a high severity authenticated remote code execution vulnerability in Craft CMS caused by missing configuration sanitization, describing its technical exploitation path and recommending an upgrade to version 5.9.14.
0000075
223 followersView on X

Explore more

Back to dashboard