Skip to content

Commit 5fdf699

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pmm4-v8f6-4vpp GHSA-86vw-x4ww-x467 GHSA-rvmm-v933-jgxq GHSA-pmm4-v8f6-4vpp
1 parent e223447 commit 5fdf699

4 files changed

Lines changed: 162 additions & 46 deletions

File tree

‎advisories/github-reviewed/2026/06/GHSA-pmm4-v8f6-4vpp/GHSA-pmm4-v8f6-4vpp.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pmm4-v8f6-4vpp",
4+
"modified": "2026-08-06T21:41:16Z",
5+
"published": "2026-06-21T15:31:24Z",
6+
"withdrawn": "2026-08-06T21:41:16Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-86vw-x4ww-x467. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "Packagist",
24+
"name": "craftcms/cms"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "5.5.0"
32+
},
33+
{
34+
"last_affected": "5.9.13"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56382"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-94"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-08-06T21:41:16Z",
62+
"nvd_published_at": "2026-06-21T14:16:25Z"
63+
}
64+
}

‎advisories/github-reviewed/2026/07/GHSA-86vw-x4ww-x467/GHSA-86vw-x4ww-x467.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-86vw-x4ww-x467",
4-
"modified": "2026-07-09T13:44:12Z",
4+
"modified": "2026-08-06T21:41:24Z",
55
"published": "2026-07-09T13:44:12Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-56382"
8+
],
79
"summary": "Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview",
810
"details": "The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` without calling `Component::cleanseConfig()`. This allows Yii2 event handler injection via `on eventName` keys in the config array, leading to arbitrary code execution.\n\nThis is the same vulnerability pattern that was fixed in GHSA-4484-8v2f-5748 (same file, `_fldComponent` method correctly uses `cleanseConfig`), GHSA-qx2q-q59v-wf3j (EntryTypesController), and GHSA-2fph-6v5w-89hh (ElementIndexesController).\n\n## PoC\n\nAs an admin user with a valid session:\n\n```\nPOST /admin/actions/fields/render-card-preview HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: CraftSessionId=<session>\n\nfieldLayoutConfig[on+init]=phpinfo&CRAFT_CSRF_TOKEN=<token>\n```\n\nWhen the FieldLayout object is constructed, Yii2 processes the `on init` key as an event handler registration. During `Component::init()`, the `init` event is triggered, calling `phpinfo()`. The phpinfo output (which includes environment variables, potentially containing database credentials and `CRAFT_SECURITY_KEY`) will appear in the response.\n\n## Impact\n\nAn authenticated admin can achieve RCE through Yii2 event handler injection. While this requires admin access (same as GHSA-4484-8v2f-5748, which was rated moderate), it allows arbitrary PHP function execution and information disclosure via phpinfo.",
911
"severity": [
@@ -41,9 +43,17 @@
4143
"type": "WEB",
4244
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56382"
49+
},
4450
{
4551
"type": "PACKAGE",
4652
"url": "https://github.com/craftcms/cms"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller"
4757
}
4858
],
4959
"database_specific": {

‎advisories/github-reviewed/2026/08/GHSA-rvmm-v933-jgxq/GHSA-rvmm-v933-jgxq.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rvmm-v933-jgxq",
4+
"modified": "2026-08-06T21:42:58Z",
5+
"published": "2026-08-06T21:42:58Z",
6+
"aliases": [],
7+
"summary": "Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics",
8+
"details": "`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.\n\nThe `viewUsers` permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base `accessCp` check inherited from the framework.\n\nEach call returns the total count of users who joined the specified group in the requested period.\n\n## Impact\n\nAny control panel user with only `accessCp` permission can obtain the total number of registered users and their registration date distribution across any time window.\n\nIn installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the `viewUsers` permission to access.\n\nNo user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "craftcms/cms"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "4.0.0-RC1"
27+
},
28+
{
29+
"fixed": "4.18.1"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Packagist",
38+
"name": "craftcms/cms"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "5.0.0-RC1"
46+
},
47+
{
48+
"fixed": "5.10.3"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxq"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce"
63+
},
64+
{
65+
"type": "PACKAGE",
66+
"url": "https://github.com/craftcms/cms"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/craftcms/cms/releases/tag/4.18.1"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/craftcms/cms/releases/tag/5.10.3"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-862"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-08-06T21:42:58Z",
84+
"nvd_published_at": null
85+
}
86+
}

‎advisories/unreviewed/2026/06/GHSA-pmm4-v8f6-4vpp/GHSA-pmm4-v8f6-4vpp.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

0 commit comments

Comments
 (0)