Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-86vw-x4ww-x467. This link is maintained to preserve external references. Original Description Craft CMS composer package craftcms/cms versions = 5.5.0 and = 5.9.13 contain a remote code execution vulnerability i...

CVE-2026-56382: Improper Control of Generation of Code

Craft CMS composer package craftcms/cms versions = 5.5.0 and = 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig...