Skip to content
Threat Feed
Subscribe

Product

Craft CMS (>= 5.5.0, <= 5.9.13)

1 brief RSS
high advisory

Craft CMS RCE via Missing cleanseConfig in FieldsController

An authenticated administrator in Craft CMS (versions 5.5.0 to 5.9.13) is vulnerable to Remote Code Execution (RCE) via a missing input sanitization vulnerability in the `actionRenderCardPreview()` method of `FieldsController`, allowing Yii2 event handler injection through specially crafted `fieldLayoutConfig` POST parameters, which enables arbitrary PHP code execution and sensitive information disclosure.

Craft CMS rce web-application cms craft-cms php
1r 1t