https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 14:40:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-328826 EUVD-2026-328826 https://cve.radiocsirt.org/vuln/euvd-2026-328826 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56382 <p>Craft CMS (composer package craftcms/cms) versions &gt;= 5.5.0 and &lt;= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., &#39;on init&#39; keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.</p> <p>Craft CMS (composer package craftcms/cms) versions &gt;= 5.5.0 and &lt;= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., &#39;on init&#39; keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56382 https://cve.radiocsirt.org/vuln/ghsa-86vw-x4ww-x467 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` without calling `Component::cleanseConfig()`. This allows Yii2 event handler injection via `on eventName` keys in the config array, leading to arbitrary code execution.</p> <p>This is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, `_fldComponent` method correctly uses `cleanseConfig`), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).</p> <p>## PoC</p> <p>As an admin user with a valid session:</p> <p>``` POST /admin/actions/fields/render-card-preview HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie: CraftSessionId=&lt;session&gt;</p> <p>fieldLayoutConfig[on+init]=phpinfo&amp;CRAFT_CSRF_TOKEN=&lt;token&gt; ```</p> <p>When the FieldLayout object is constructed, Yii2 processes the `on init` key as an event handler registration. During `Component::init()`, the `init` event is triggered, calling `phpinfo()`. The phpinfo output (which includes environment variables, potentially containing database credentials and `CRAFT_SECURITY_KEY`) will appear in the response.</p> <p>## Impact</p> <p>An authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` without calling `Component::cleanseConfig()`. This allows Yii2 event handler injection via `on eventName` keys in the config array, leading to arbitrary code execution.</p> <p>This is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, `_fldComponent` method correctly uses `cleanseConfig`), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).</p> <p>## PoC</p> <p>As an admin user with a valid session:</p> <p>``` POST /admin/actions/fields/render-card-preview HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie: CraftSessionId=&lt;session&gt;</p> <p>fieldLayoutConfig[on+init]=phpinfo&amp;CRAFT_CSRF_TOKEN=&lt;token&gt; ```</p> <p>When the FieldLayout object is constructed, Yii2 processes the `on init` key as an event handler registration. During `Component::init()`, the `init` event is triggered, calling `phpinfo()`. The phpinfo output (which includes environment variables, potentially containing database credentials and `CRAFT_SECURITY_KEY`) will appear in the response.</p> <p>## Impact</p> <p>An authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.</p> https://cve.radiocsirt.org/vuln/ghsa-86vw-x4ww-x467