CVE-2026-32263: Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parsestr is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.
Other sources
The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in EntryTypesController::actionApplyOverrideSettings().
In src/controllers/EntryTypesController.php lines 381-387:
php $settingsStr = $this->request->getBodyParam('settings'); parsestr($settingsStr, $postedSettings); $settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace'); $settings = arrayfilter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));
if (!empty($settings)) { Craft::configure($entryType, $settings);
The $settings array from parsestr is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via as or on prefixed keys, the same attack vector as the original advisory.
You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.
An attacker can use the same gadget chain from the original advisory to achieve RCE.
Users should update to Craft 5.9.11 to mitigate the issue.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32263?
CVE-2026-32263 has a critical severity rating due to the potential for remote code execution.
How do I fix CVE-2026-32263?
To mitigate CVE-2026-32263, upgrade Craft CMS to version 5.9.11 or later.
What versions of Craft CMS are affected by CVE-2026-32263?
CVE-2026-32263 affects Craft CMS versions from 5.6.0 to before 5.9.11.
What kind of attack does CVE-2026-32263 enable?
CVE-2026-32263 enables behavior injection leading to remote code execution.
Where can I find more information about CVE-2026-32263?
Further details about CVE-2026-32263 can be found in related security advisory documents.