CVE-2026-56382 Overview
CVE-2026-56382 is a remote code execution (RCE) vulnerability in Craft CMS, the PHP-based content management system distributed as the craftcms/cms Composer package. Versions >= 5.5.0 and <= 5.9.13 are affected. The flaw resides in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated administrator can inject Yii2 event handlers through this parameter to achieve arbitrary PHP execution. The vulnerability is classified under CWE-94: Improper Control of Generation of Code and is fixed in version 5.9.14.
Critical Impact
Authenticated admin attackers can execute arbitrary PHP code on the host, disclose environment variables, and steal database credentials and the CRAFT_SECURITY_KEY.
Affected Products
- Craft CMS (craftcms/cms) versions >= 5.5.0
- Craft CMS (craftcms/cms) versions <= 5.9.13
- Fixed in Craft CMS 5.9.14
Discovery Timeline
- 2026-06-21 - CVE-2026-56382 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-56382
Vulnerability Analysis
The vulnerability stems from unsanitized configuration data reaching the field layout constructor. Craft CMS exposes the FieldsController::actionRenderCardPreview() endpoint to authenticated administrators for previewing card layouts. The controller reads the fieldLayoutConfig POST parameter and forwards it unchanged to Fields::createLayout(). Other Craft CMS code paths normalize such input through Component::cleanseConfig(), which strips dangerous keys before instantiating components. This sanitization step is missing here, allowing arbitrary Yii2 component configuration to flow into object construction.
The practical result is arbitrary PHP execution within the Craft CMS process. Attackers can read environment variables that hold database credentials and the CRAFT_SECURITY_KEY, which protects session integrity and encrypted values throughout the application.
Root Cause
The root cause is a missing call to Component::cleanseConfig() on attacker-controlled input before passing it to the Yii2 component factory. Yii2 treats configuration keys prefixed with on as event handlers and binds them to callbacks during object initialization. Without sanitization, an on init key with a PHP callable value executes when Fields::createLayout() constructs the layout object.
Attack Vector
Exploitation requires an authenticated session with administrator privileges. The attacker sends a crafted POST request to the card preview endpoint with a fieldLayoutConfig body containing a malicious on init event handler. The handler value is a PHP callable that runs arbitrary code during layout instantiation. The attacker can then exfiltrate $_ENV contents, including database credentials and the CRAFT_SECURITY_KEY, enabling forged sessions and decryption of stored secrets. See the GitHub Security Advisory GHSA-86vw-x4ww-x467 and the VulnCheck advisory for additional technical detail.
Detection Methods for CVE-2026-56382
Indicators of Compromise
- POST requests to the Craft CMS controller action fields/render-card-preview containing a fieldLayoutConfig parameter with keys beginning with on (for example on init, on beforeSave).
- Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts shortly after admin authentication.
- Unexpected child processes spawned by the web server user, or PHP processes invoking system, exec, passthru, or proc_open.
- Web server logs showing access to administrative endpoints from atypical source IPs or user agents.
Detection Strategies
- Inspect HTTP request bodies routed to the Craft control panel for serialized PHP callables or event-handler keys in fieldLayoutConfig.
- Correlate admin login events with subsequent calls to actionRenderCardPreview and flag anomalous payload sizes.
- Compare deployed craftcms/cms package version against the fixed 5.9.14 release using composer show or dependency scanners.
Monitoring Recommendations
- Forward Craft CMS application logs and web server access logs to a centralized SIEM with retention sufficient for retrospective hunting.
- Alert on creation of new admin accounts and on changes to the CRAFT_SECURITY_KEY or .env files.
- Monitor database connection patterns for credential reuse from unexpected source IPs, which may indicate stolen credentials from environment disclosure.
How to Mitigate CVE-2026-56382
Immediate Actions Required
- Upgrade craftcms/cms to version 5.9.14 or later via composer update craftcms/cms.
- Rotate the CRAFT_SECURITY_KEY, all database credentials, and any other secrets stored in the Craft environment after patching.
- Audit administrator accounts and remove or disable any unused or unrecognized admin users.
- Review web server logs for prior requests to fields/render-card-preview containing on-prefixed keys to identify possible compromise.
Patch Information
Craft CMS resolved the issue in version 5.9.14 by adding the missing Component::cleanseConfig() call in FieldsController::actionRenderCardPreview(). The fix strips event-handler keys from attacker-supplied configuration before component instantiation. Refer to the GitHub Security Advisory GHSA-86vw-x4ww-x467 for the upstream commit reference.
Workarounds
- Restrict access to the Craft CMS control panel by IP allowlist at the reverse proxy or web application firewall layer until patching is complete.
- Enforce strong authentication and multi-factor authentication for all administrator accounts to reduce the prerequisite attack surface.
- Temporarily revoke administrator privileges for accounts that do not require them during the remediation window.
# Configuration example: upgrade Craft CMS to the patched release
composer require craftcms/cms:^5.9.14 --update-with-dependencies
php craft migrate/all
php craft clear-caches/all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
