{"id":"CVE-2026-32263","aliases":["GHSA-qx2q-q59v-wf3j"],"url":"https://o3.security/vulnerability/CVE-2026-32263","summary":"Craft CMS vulnerable to behavior injection RCE via EntryTypesController","details":"The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `EntryTypesController::actionApplyOverrideSettings()`.\n\nIn `src/controllers/EntryTypesController.php` lines 381-387:\n\n```php\n$settingsStr = $this->request->getBodyParam('settings');\nparse_str($settingsStr, $postedSettings);\n$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');\n$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));\n\nif (!empty($settings)) {\n    Craft::configure($entryType, $settings);\n```\n\nThe `$settings` array from `parse_str` is passed directly to `Craft::configure()` without `Component::cleanseConfig()`. This allows injecting Yii2 behavior/event handlers via `as ` or `on ` prefixed keys, the same attack vector as the original advisory.\n\nYou need Craft control panel administrator permissions, and `allowAdminChanges` must be enabled for this to work.\n\nAn attacker can use the same gadget chain from the original advisory to achieve RCE.\n\nUsers should update to Craft 5.9.11 to mitigate the issue.","published":"2026-03-16T18:57:50.342Z","modified":"2026-08-12T03:51:36.490244990Z","cvss":null,"epss":{"score":0.00499,"percentile":0.41578,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.9.11"}],"fix":{"url":"https://github.com/craftcms/cms/commit/d37389dbffafa565143be40a2ab1e1db22a863f7","label":"craftcms/cms@d37389d"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32263.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qx2q-q59v-wf3j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32263"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/d37389dbffafa565143be40a2ab1e1db22a863f7"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.490244990Z"}}