Craft CMS RCE and Auth Bypass Flush

Craft CMS ships emergency patches for a remote code execution bug and multiple access-control holes. CVE-2026-56382 is a critical RCE in Craft CMS 5.5.0 through 5.9.13 that lives in the FieldsController::actionRenderCardPreview() method, where the fieldLayoutConfig POST parameter is passed directly to an unsafe deserialization path — no authentication bypass is needed beyond a valid Control Panel session. Separately, CVE-2026-56385 and CVE-2026-56384 let any authenticated user preview thumbnails and files of private assets they should not have access to, bypassing per-asset view authorization. CVE-2026-56394 adds an authenticated path traversal in the assets/icon endpoint that passes a truncated extension check. A cluster of stored XSS bugs (CVE-2026-56393, CVE-2026-56381, CVE-2026-56383) round out the batch, affecting settings names, user group names, and editable table row headings. Administrators should upgrade to Craft CMS 4.17.0 / 5.9.0 or later immediately.

SiYuan Note Bazaar marketplace flaws enable remote code execution via malicious packages. CVE-2026-56397 and CVE-2026-56395 describe identical vulnerabilities in SiYuan Note before v3.6.1: the Bazaar marketplace fails to sanitize package metadata and README content, allowing a malicious package author to inject arbitrary HTML and JavaScript. Any user who browses or installs the poisoned package triggers the payload in the context of the SiYuan application, leading to full remote code execution. The attack requires no special privileges — only that a victim visits the malicious package listing. Users should update to SiYuan v3.6.1 or later.

phpMyFAQ privilege-escalation bug lets admins promote themselves to SuperAdmin. CVE-2026-56396 affects phpMyFAQ before 4.1.4 and stems from missing authorization checks in the editUser() and updateUserRights() endpoints. An authenticated administrator who holds the edit_user permission — but is not a SuperAdmin — can set the is_superadmin flag on their own account, effectively granting themselves full platform control. The vulnerability is straightforward to exploit once an attacker has any admin-level session. Upgrading to phpMyFAQ 4.1.4 closes the authorization gap.

Libexpat patches a wave of integer overflows and a use-after-free in the XML parser library. Eight integer-overflow CVEs (CVE-2026-56411, CVE-2026-56410, CVE-2026-56409, CVE-2026-56408, CVE-2026-56407, CVE-2026-56406, CVE-2026-56405, CVE-2026-56404, CVE-2026-56403) and one use-after-free (CVE-2026-56412) were disclosed in libexpat versions before 2.8.2. The integer overflows span functions including copyString, doProlog, XML_ParseBuffer, getAttributeId, addBinding, storeAtts, resolveSystemId, and the -d outputDir filename handling in xmlwf. The use-after-free in CVE-2026-56412 arises because the parser fails to track handler call depth for XML_TOK_DATA_CHARS in doCdataSection when a policy violation occurs. While libexpat is a ubiquitous dependency embedded in countless applications, no active exploitation has been reported yet. Upgrading to libexpat 2.8.2 resolves all nine issues.

Craft CMS XSS and authorization bypasses continue to surface across multiple versions. Beyond the RCE and path-traversal bugs, Craft CMS 4.x and 5.x carry several stored cross-site scripting vulnerabilities. CVE-2026-56393 covers unsanitized rendering of settings names and field option labels. CVE-2026-56381 targets the User Permissions page where user group names lack HTML escaping. CVE-2026-56383 exploits the editableTable.twig component's 'Row Heading' column type, where default values are not sanitized. All three require admin-level access to inject the payload, but the stored nature means any user viewing the affected pages will execute the script. These bugs are fixed in the same Craft CMS 4.17.0 / 5.9.0 releases that address the higher-severity issues.