{"action":"Upgrade craftcms/cms to 5.9.14 or later.","affected":[{"fixed":"5.9.14","introduced":"5.5.0"}],"component":"craftcms/cms","cve_ids":["CVE-2026-56382"],"ecosystem":"Packagist","epss":0.00676,"exploited":false,"fixed_versions":["5.9.14"],"ghsa_id":"GHSA-86vw-x4ww-x467","id":"tcs_01M5KEYRAEPSM8X004896RCB6Y","modified_at":"2026-08-06T21:45:58.113576927Z","published_at":"2026-07-09T13:44:12Z","references":["https://osv.dev/vulnerability/GHSA-86vw-x4ww-x467","https://github.com/craftcms/cms/security/advisories/GHSA-86vw-x4ww-x467","https://nvd.nist.gov/vuln/detail/CVE-2026-56382","https://github.com/craftcms/cms","https://www.vulncheck.com/advisories/craft-cms-remote-code-execution-via-missing-config-sanitization-in-fieldscontroller"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-86vw-x4ww-x467","url":"https://osv.dev/vulnerability/GHSA-86vw-x4ww-x467"}],"summary":"Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview"}