Which versions of Craft CMS are affected by CVE-2026-56382?

A critical vulnerability in Craft CMS (versions 5.5.0-5.9.13) could allow authenticated administrators with malicious intent to extract sensitive database credentials and encryption keys, posing a…. A patch is available.

Is there a public PoC exploit available for CVE-2026-56382?

Yes, a public proof-of-concept exploit is available for CVE-2026-56382. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-56382?

Within 24 hours: Audit systems to identify all Craft CMS instances in versions 5.5.0-5.9.13 and verify which are actively in use. Within 7 days: Upgrade all affected instances to Craft CMS version 5.9.14 or later (vendor-released patch available). Within 30 days: Rotate all database credentials and CRAFT_SECURITY_KEY values; review authentication logs for any unauthorized administrative activity during the exposure period.

Craft CMS CVE-2026-56382

Q: What is the CVSS score of CVE-2026-56382?

CVE-2026-56382 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-38176 HIGH

Code Injection (CWE-94)

2026-06-21 VulnCheck

GHSA-pmm4-v8f6-4vpp

GHSA-86vw-x4ww-x467

PHP RCE Code Injection Cms Craftcms

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable admin endpoint (AV:N/AC:L), requires admin authentication (PR:H), no user interaction, and arbitrary PHP execution yields full C/I/A impact within the application scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:07 vuln.today

Patch available

Jun 21, 2026 - 15:31 EUVD

DescriptionCVE.org

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

AnalysisAI

Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary PHP by injecting Yii2 event handlers via the fieldLayoutConfig POST parameter to FieldsController::actionRenderCardPreview(). The flaw stems from missing Component::cleanseConfig() sanitization, enabling disclosure of environment variables including database credentials and CRAFT_SECURITY_KEY. No public exploit identified at time of analysis, though VulnCheck has published a detailed advisory describing the attack technique.

Technical ContextAI

Craft CMS is a PHP-based content management system built on the Yii2 framework (composer package craftcms/cms). Yii2 supports configuration-driven object instantiation where array keys prefixed with 'on' (e.g., 'on init') register event handlers that fire during object lifecycle events. The vulnerability is a classic CWE-94 Code Injection: the FieldsController::actionRenderCardPreview() method passes user-supplied fieldLayoutConfig POST data directly to Fields::createLayout() without first invoking Component::cleanseConfig(), which is Craft's documented sanitizer that strips dangerous keys like 'as' (behaviors) and 'on' (event handlers) from configuration arrays. The CPE cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* confirms the craftcms/cms product family is universally affected within the stated version range.

RemediationAI

Vendor-released patch: upgrade craftcms/cms to version 5.9.14 or later via composer (composer require craftcms/cms:^5.9.14), as documented in the vendor advisory at https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467 and detailed by VulnCheck at https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller. As a temporary compensating control if immediate patching is not possible, restrict network access to the /admin control panel (specifically the fields/render-card-preview endpoint) via IP allowlisting at the web server or WAF tier - note this breaks legitimate remote admin access for users outside the allowlist. Additionally, rotate any admin credentials suspected of compromise and, post-upgrade, rotate the CRAFT_SECURITY_KEY and database credentials in case they were already exfiltrated, since the key drives cryptographic operations across the application.