https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:40:34.026285+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328826 EUVD-2026-328826 2026-10-08T14:40:34.028467+00:00 EUVD-2026-328826 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56382 fkie_cve-2026-56382 2026-10-08T14:40:34.028498+00:00

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

 https://cve.radiocsirt.org/vuln/ghsa-86vw-x4ww-x467 GHSA-86vw-x4ww-x467 — Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview 2026-10-08T14:40:34.028532+00:00

Affected: Packagist: craftcms/cms

The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` without calling `Component::cleanseConfig()`. This allows Yii2 event handler injection via `on eventName` keys in the config array, leading to arbitrary code execution.

This is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, `_fldComponent` method correctly uses `cleanseConfig`), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).

## PoC

As an admin user with a valid session:

``` POST /admin/actions/fields/render-card-preview HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie: CraftSessionId=<session>

fieldLayoutConfig[on+init]=phpinfo&CRAFT_CSRF_TOKEN=<token> ```

When the FieldLayout object is constructed, Yii2 processes the `on init` key as an event handler registration. During `Component::init()`, the `init` event is triggered, calling `phpinfo()`. The phpinfo output (which includes environment variables, potentially containing database credentials and `CRAFT_SECURITY_KEY`) will appear in the response.

## Impact

An authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.