The actionRenderCardPreview() method in Craft CMS's FieldsController improperly handles the fieldLayoutConfig POST parameter by passing it directly to Fields::createLayout() without invoking Component::cleanseConfig(). This omission permits Yii2 event handler injection through specially crafted 'on eventName' keys in the configuration array, resulting in arbitrary code execution. The vulnerability requires authenticated admin access and mirrors a previously fixed pattern in other parts of the application. A proof-of-concept demonstrates that an attacker can trigger PHP functions like phpinfo() during object initialization, exposing sensitive environment details including database credentials and security keys.

An attacker with authenticated admin privileges can achieve remote code execution on the affected Craft CMS instance by injecting Yii2 event handlers via the fieldLayoutConfig parameter. This leads to arbitrary PHP function execution and potential disclosure of sensitive environment information, including database credentials and security keys. The vulnerability poses a high risk due to the severity of impact, although it requires high privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin access to trusted users only and monitor for suspicious activity. Avoid exposing the affected endpoint to untrusted networks. Follow vendor updates closely for a security patch addressing this issue.