Executive brief
Craft CMS, a popular content management system, contains a security flaw that allows an administrative user to execute unauthorized commands on the server. By exploiting this vulnerability, an attacker with admin access could take full control of the website, steal sensitive database credentials, or disrupt business operations. This issue has been resolved in the latest software update.
Technical details
A remote code execution (RCE) vulnerability exists in the FieldsController::actionRenderCardPreview() method of Craft CMS. The root cause is the direct passing of the 'fieldLayoutConfig' POST parameter to Fields::createLayout() without invoking Component::cleanseConfig() for sanitization. An authenticated attacker with administrative privileges can inject Yii2 event handlers (such as 'on init') into the configuration array. This leads to the execution of arbitrary PHP code when the FieldLayout object is initialized. The vulnerability can be used to disclose environment variables, including database credentials and security keys, and is fixed in version 5.9.14.
Affected products
- Craft CMS cms >= 5.5.0, <= 5.9.13
Timeline
- 2026-06-02: advisory: Vendor advisory GHSA-86vw-x4ww-x467 published
- 2026-06-21: disclosed: CVE-2026-56382 published to NVD
- 2026-06-21: patched: Fix released in version 5.9.14