---
id: CVE-2026-56382
title: >-
  Craft CMS - Remote Code Execution via Missing Config Sanitization in
  FieldsController
summary: >-
  Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13
  contain a remote code execution vulnerability in the
  FieldsController::actionRenderCardPreview() method, which passes the
  fieldLayoutConfig POST parameter directly…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: craftcms
product: cms
affected:
  - cms >= 5.5.0 < 5.9.14
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-22T10:30:00.918233Z'
exploitAvailable: true
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:08.481Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56382'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467'
    label: GitHub Security Advisory (GHSA-86vw-x4ww-x467)
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller
    label: >-
      VulnCheck Advisory: Craft CMS - Remote Code Execution via Missing Config
      Sanitization in FieldsController
tags:
  - cve.org
  - exploit-available
epss: 0.00676
epssPercentile: 0.52486
ingestedAt: '2026-11-08T14:51:22.352Z'
---

## Overview

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

## Affected

- `cms >= 5.5.0 < 5.9.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.