GHSA-86vw-x4ww-x467

Source

https://github.com/advisories/GHSA-86vw-x4ww-x467

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-86vw-x4ww-x467/GHSA-86vw-x4ww-x467.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-86vw-x4ww-x467

Aliases

CVE-2026-56382

Published

2026-07-09T13:44:12Z

Modified

2026-08-06T21:45:58Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

Details

The actionRenderCardPreview() method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution.

This is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, _fldComponent method correctly uses cleanseConfig), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).

PoC

As an admin user with a valid session:

POST /admin/actions/fields/render-card-preview HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: CraftSessionId=<session>

fieldLayoutConfig[on+init]=phpinfo&CRAFT_CSRF_TOKEN=<token>

When the FieldLayout object is constructed, Yii2 processes the on init key as an event handler registration. During Component::init(), the init event is triggered, calling phpinfo(). The phpinfo output (which includes environment variables, potentially containing database credentials and CRAFT_SECURITY_KEY) will appear in the response.

Impact

An authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-09T13:44:12Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Packagist / craftcms/cms

Package

Name: craftcms/cms
Purl: pkg:composer/craftcms/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.5.0

Fixed

5.9.14

Affected versions

5.*

5.5.0

5.5.0.1

5.5.1

5.5.1.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.6.1

5.5.7

5.5.8

5.5.9

5.5.10

5.6.0

5.6.0.1

5.6.0.2

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.5.1

5.6.6

5.6.7

5.6.8

5.6.9

5.6.9.1

5.6.10

5.6.10.1

5.6.10.2

5.6.11

5.6.12

5.6.13

5.6.14

5.6.15

5.6.16

5.6.17

5.7.0-beta.1

5.7.0-beta.2

5.7.0

5.7.1

5.7.1.1

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.8.1

5.7.8.2

5.7.9

5.7.10

5.7.11

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.8.10

5.8.11

5.8.12

5.8.13

5.8.13.1

5.8.13.2

5.8.14

5.8.15

5.8.16

5.8.17

5.8.18

5.8.19

5.8.20

5.8.21

5.8.22

5.8.23

5.9.0-beta.1

5.9.0-beta.2

5.9.0

5.9.1

5.9.2

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

5.9.8

5.9.9

5.9.10

5.9.11

5.9.12

5.9.13

Database specific

last_known_affected_version_range

"<= 5.9.13"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-86vw-x4ww-x467/GHSA-86vw-x4ww-x467.json"