Craft CMS (composer package craftcms/cms) versions >=5.5.0 and <=5.9.13 have a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method. The issue arises because the fieldLayoutConfig POST parameter is passed directly to Fields::createLayout() without cleansing via Component::cleanseConfig(). This omission allows an authenticated admin user to inject Yii2 event handlers (e.g., 'on init' keys) to execute arbitrary PHP code and disclose sensitive data including environment variables containing database credentials and the CRAFT_SECURITY_KEY. The vulnerability is addressed in version 5.9.14.

An authenticated administrator can exploit this vulnerability to execute arbitrary PHP code remotely, potentially leading to full system compromise. Additionally, sensitive information such as environment variables, database credentials, and security keys may be disclosed. The CVSS v3.1 score is 7.2 (High), reflecting the network attack vector, low attack complexity, required high privileges, no user interaction, and high confidentiality, integrity, and availability impacts.

Upgrade Craft CMS to version 5.9.14 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory stating the issue is resolved in 5.9.14.