CVE-2026-56382

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.5.0 through 5.9.13

Description An issue exists in the FieldsController::actionRenderCardPreview() method where the fieldLayoutConfig POST parameter is passed directly to Fields::createLayout() without being processed by Component::cleanseConfig(). This lack of sanitization allows an authenticated admin user to inject Yii2 event handlers, such as on init keys, via the fieldLayoutConfig parameter. This can lead to the execution of arbitrary PHP code and the disclosure of sensitive information, including the CRAFT SECURITY KEY and environment variables containing database credentials.

Recommendations Update to version 5.9.14.