CVE-2026-56382: Craft CMS Remote Code Execution via Field Layout Config Injection

Technical summary

The vulnerability exists in the FieldsController::actionRenderCardPreview() method, which accepts a fieldLayoutConfig POST parameter and passes it directly to Fields::createLayout() without invoking the Component::cleanseConfig() sanitization method. This permits injection of Yii2 event handlers (such as 'on init' keys) that execute arbitrary PHP code during object instantiation. An authenticated admin user can leverage this to achieve remote code execution and access environment variables containing sensitive configuration data, including CRAFT_SECURITY_KEY and database connection strings. The flaw is rooted in insufficient input validation on a privileged endpoint.

Business impact

Compromise of a Craft CMS administrator account becomes significantly more dangerous with this vulnerability present. An attacker with admin access—whether through credential theft, insider threat, or compromise of another admin—can escalate to full server-level code execution and exfiltrate critical secrets. This puts databases, API keys, and other protected assets at risk. For organizations running Craft CMS as a content management backbone, this translates to potential data breach, service disruption, and regulatory compliance violations. The window of exposure (versions 5.5.0–5.9.13) affects multiple minor release lines, suggesting a broader installed base may be vulnerable.

Affected systems

Craft CMS instances running composer package craftcms/cms versions 5.5.0 through 5.9.13 inclusive are vulnerable. The attack requires an authenticated administrator user, so only installations with compromised or malicious admin accounts face immediate active risk. Version 5.9.14 and later are patched. Craft CMS 4.x and earlier major versions are not affected by this specific issue. Organizations should audit their installed version via composer.lock or the Craft control panel.

Exploitability

Exploitation requires valid admin credentials and direct network access to the Craft CMS application. The attack surface is limited to authenticated users in the administrator role, reducing the pool of potential attackers. However, the barrier to exploitation once admin access is obtained is low—the attacker need only craft a POST request to the card preview endpoint with a specially formatted fieldLayoutConfig parameter. No complex interaction, race conditions, or user interaction is required. The CVSS vector (AV:N/AC:L/PR:H) reflects the network-accessible nature and high privilege requirement. Real-world risk depends on the strength of admin credential hygiene and whether the CMS faces external exposure.

Remediation

Organizations must upgrade Craft CMS to version 5.9.14 or later. Verify the update via composer update or by checking the installed version in the Craft control panel. After patching, verify that the FieldsController::actionRenderCardPreview() method no longer passes unvalidated input to Fields::createLayout(). Additionally, conduct an audit of admin user accounts and review access logs for suspicious field layout preview requests, particularly those with unusual fieldLayoutConfig payloads, to detect prior exploitation. Consider implementing Web Application Firewall (WAF) rules to detect or block requests containing Yii2 event handler syntax to the vulnerable endpoint as a temporary defense.

Patch guidance

Upgrade craftcms/cms to version 5.9.14 or later using composer: 'composer require craftcms/cms:^5.9.14' or 'composer update craftcms/cms'. After running the update, clear all caches (control panel > Utilities > Clear Caches or via 'php craft cache/flush-all'). Verify the upgrade by navigating to Settings > Craft in the control panel to confirm the version number. For organizations with custom plugins or extensions that depend on FieldsController or Fields, test thoroughly in a staging environment before deploying to production. Document the patch date and version for compliance records.

Detection guidance

Monitor HTTP POST requests to the card preview endpoint (typically /admin/fields/render-card-preview or similar) for payloads containing Yii2 event handler syntax, such as strings containing 'on init', 'on afterConstruct', or other Yii2 event keys within the fieldLayoutConfig parameter. Log and alert on any such requests from admin users. Review access logs and web server logs for unusual patterns in field layout endpoint requests. If you have access to Craft CMS application logs, look for errors or exceptions during field layout creation that correlate with suspicious request timestamps. Check environment variable exposure in error logs or debug mode output that may indicate prior code execution.

Why prioritize this

Although exploitation requires high privilege (authenticated admin), the impact is severe (remote code execution, credential disclosure, and data exfiltration). The vulnerability affects a wide version range (5.5.0–5.9.13), and Craft CMS is used by many organizations for mission-critical content management. The simplicity of exploitation once admin access is obtained, combined with the high-value assets at risk (database credentials, encryption keys), warrants prompt remediation. This should be prioritized above vulnerabilities requiring lower privilege or user interaction, but below network-accessible unauthenticated RCE issues.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects a network-accessible vulnerability with low attack complexity and high impact on confidentiality, integrity, and availability. However, the requirement for admin privileges (PR:H) prevents a critical rating. The score accurately captures the severity in the context of a privileged insider threat or compromised admin account, but does not account for the real-world difficulty of obtaining admin credentials. Organizations should apply business context: if admin accounts are well-protected, risk is moderate; if credential hygiene is poor or the CMS is internet-facing, risk escalates. Apply this score as a floor and adjust based on your environment's threat model and admin access controls.

Frequently asked questions