Iniciar sesión
Deutsch English Español Polski
Alta

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

  • Publicada: 09.07.2026
  • Actualizado: 11.10.2026 10:22

The actionRenderCardPreview() method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution.

This is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, _fldComponent method correctly uses cleanseConfig), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).

PoC

As an admin user with a valid session:

POST /admin/actions/fields/render-card-preview HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: CraftSessionId=<session>

fieldLayoutConfig[on+init]=phpinfo&CRAFT_CSRF_TOKEN=<token>

When the FieldLayout object is constructed, Yii2 processes the on init key as an event handler registration. During Component::init(), the init event is triggered, calling phpinfo(). The phpinfo output (which includes environment variables, potentially containing database credentials and CRAFT_SECURITY_KEY) will appear in the response.

Impact

An authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer craftcms/cms >= 5.5.0, < 5.9.14 5.9.14

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Debilidad (CWE)
CWE-94
Plataforma
Composer
Paquete
craftcms/cms
Publicada
09.07.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-86vw-x4ww-x467 - CC BY 4.0

Historial de vulnerabilidades: craftcms/cms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (127) en el archivo
Entradas en total
127
Primera → última
07.2021 08.2026
Sin corrección
6
Explotada en ataques
4

Distribución por gravedad

  • Crítica 9
  • Alta 41
  • Media 65
  • Baja 12

Divulgaciones por año

Gravedad:
  1. Craft CMS: Passkey login accepts replayed WebAuthn assertions
    Crítica CVE-2026-72780 >= 5.0.0-RC1, < 5.10.5 5.10.5
  2. Craft CMS: Arbitrary user password reset leading to administrator account takeover
    Alta CVE-2026-72786 >= 5.0.0-RC1, < 5.10.8 5.10.8
  3. Craft CMS: Authenticated RCE through Twig sandbox escape
    Alta CVE-2026-72781 >= 5.0.0-RC1, < 5.10.7, >= 4.0.0-RC1, < 4.18.3 5.10.7, 4.18.3
  4. Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
    Alta CVE-2026-72778 >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2
  5. Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview esta entrada
    Alta CVE-2026-56382 >= 5.5.0, < 5.9.14 5.9.14
  6. Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
    Alta CVE-2026-55794 >= 5.9.0, < 5.10.0 5.10.0
  7. Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
    Alta CVE-2026-55790 >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16 5.9.23, 4.17.16
  8. Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
    Alta CVE-2026-50282 >= 5.0.0-RC1, < 5.9.21, >= 4.0.0-RC1, < 4.17.14 5.9.21, 4.17.14
  9. Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
    Alta CVE-2026-50281 >= 5.7.0, < 5.9.21 5.9.21
  10. Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
    Alta CVE-2026-50284 >= 5.0.0-RC1, < 5.9.22, >= 4.0.0-RC1, < 4.17.15 5.9.22, 4.17.15
  11. Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
    Alta CVE-2026-50279 >= 5.0.0-RC1, < 5.9.21 5.9.21
  12. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
    Crítica CVE-2026-55791 >= 5.0.0-RC1, < 5.10, >= 4.0.0-RC1, < 4.18 5.10, 4.18
  13. Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
    Alta CVE-2026-44012 >= 5.0.0-RC1, < 5.9.18 5.9.18
  14. Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-44011 >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 4.17.12, 5.9.18
  15. Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
    Alta CVE-2026-44010 >= 5.0.0, < 5.9.18, >= 4.0.0, < 4.17.12 5.9.18, 4.17.12
  16. Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-33157 >= 5.6.0, < 5.9.13 5.9.13
  17. Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    Alta CVE-2026-32267 >= 4.0.0-RC1, < 4.17.6, >= 5.0.0-RC1, < 5.9.12 4.17.6, 5.9.12
  18. Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    Alta CVE-2026-32264 >= 4.0.0-RC1, < 4.17.5, >= 5.0.0-RC1, < 5.9.11 4.17.5, 5.9.11
  19. Craft CMS vulnerable to behavior injection RCE via EntryTypesController
    Alta CVE-2026-32263 >= 5.6.0, < 5.9.11 5.9.11
  20. CraftCMS has an RCE vulnerability via relational conditionals in the control panel
    Alta CVE-2026-31857 >= 5.0.0-RC1, < 5.9.9, >= 4.0.0-beta.1, < 4.17.4 5.9.9, 4.17.4
Mostrar más (20) Mostrando 20 de 50

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.