Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 have a remote code execution vulnerability due to improper control of code generation in the FieldsController::actionRenderCardPreview() method. The vulnerability arises because the fieldLayoutConfig POST parameter is passed directly to Fields::createLayout() without sanitization via Component::cleanseConfig(). An authenticated admin can exploit this by injecting Yii2 event handlers (e.g., 'on init' keys) to execute arbitrary PHP code and access sensitive data such as environment variables containing database credentials and the CRAFT_SECURITY_KEY. The issue is resolved in version 5.9.14.

An authenticated administrator can exploit this vulnerability to execute arbitrary PHP code remotely, potentially leading to full system compromise. Sensitive information including environment variables with database credentials and security keys can be disclosed, increasing the risk of further attacks or data breaches.

Upgrade Craft CMS to version 5.9.14 or later, where this vulnerability is fixed. Since the vulnerability requires authenticated admin access, ensure that admin credentials are protected and monitor for any suspicious activity. Patch status is confirmed fixed in 5.9.14.