PT-2026-51230 · Craft Cms · Cms

Q1Uf3Ng · Publicado 2026-06-21 · Atualizado 2026-06-21 · CVE-2026-56382

Mitre

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT SECURITY KEY). The issue is fixed in version 5.9.14.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-56382

Produtos afetados

Cms

Referências · 3

• https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467 · Aviso do Fabricante
• https://vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56382 · Nota de Segurança