CVE-2026-32263: 
PHP vulnerability analysis and mitigation

CVE-2026-32263 is a behavior injection Remote Code Execution (RCE) vulnerability in Craft CMS, resulting from an incomplete fix for a prior advisory (GHSA-7jx7-3846-m7w7). The original patch only addressed src/services/Fields.php, leaving the same vulnerable pattern in EntryTypesController::actionApplyOverrideSettings(). Affected versions are Craft CMS 5.6.0 through 5.9.10 (Composer package craftcms/cms); version 5.9.11 contains the fix. It was disclosed on March 16, 2026, with a CVSS v3.1 score of 7.2 (High) and a CVSS v4.0 score of 8.6 (High) (Github Advisory, Craft CMS Advisory).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection) and CWE-94 (Code Injection). In src/controllers/EntryTypesController.php (lines 381–387), user-supplied settings body parameters are parsed via parse_str() and passed directly to Craft::configure() without first calling Component::cleanseConfig() to strip dangerous keys. This allows an attacker to inject Yii2 behavior or event handlers using as or on prefixed keys in the settings payload, leveraging the same gadget chain documented in GHSA-7jx7-3846-m7w7 (e.g., attaching AttributeTypecastBehavior with a callback to ConsoleProcessus::execute) to achieve arbitrary command execution. Exploitation requires Craft control panel administrator privileges and the allowAdminChanges configuration option to be enabled (Craft CMS Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands on the server with the privileges of the web server process, resulting in full compromise of confidentiality, integrity, and availability of the affected Craft CMS installation. An attacker could exfiltrate sensitive data (database credentials, user data, API keys), modify or delete CMS content and configurations, install backdoors, or disrupt service availability. While the attack is scoped to the vulnerable system (no lateral movement to subsequent systems is indicated by the CVSS scoring), the web server process context may provide access to adjacent internal resources (Github Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The EPSS score is approximately 0.012% (0.000120), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (Craft control panel administrator access) and a specific non-default configuration (allowAdminChanges enabled), which limits the practical attacker pool (Github Advisory).

1. Reconnaissance: Identify Craft CMS installations running versions 5.6.0–5.9.10 with the control panel exposed. Confirm that allowAdminChanges is enabled (typically set in config/general.php).
2. Obtain administrator credentials: Acquire valid Craft control panel administrator credentials through phishing, credential stuffing, or insider access — this vulnerability cannot be exploited without admin-level authentication.
3. Authenticate to the control panel: Log in to the Craft CMS admin panel (e.g., /admin) using the obtained credentials.
4. Craft malicious payload: Construct a POST request body targeting the actionApplyOverrideSettings endpoint. Include a settings parameter containing a query-string-encoded payload with an as [behaviorName] prefixed key that injects a malicious Yii2 AttributeTypecastBehavior configuration, specifying a typecastAfterValidate callback pointing to ConsoleProcessus::execute with the desired shell command as the uid attribute value.
5. Submit the request: Send the crafted POST request to the vulnerable endpoint (e.g., /index.php?p=admin/actions/entry-types/apply-override-settings). The parse_str() call parses the payload, and the resulting $settings array (without cleanseConfig() sanitization) is passed to Craft::configure(), attaching the malicious behavior.
6. Trigger code execution: The injected behavior fires when the entry type model is validated, causing EVENT_AFTER_VALIDATE to trigger typecastAfterValidate, which calls ConsoleProcessus::execute with the attacker-controlled command, achieving RCE on the server (Craft CMS Advisory, Original Advisory).

• Network: Unusual POST requests to /index.php?p=admin/actions/entry-types/apply-override-settings or equivalent admin action routes containing as or on prefixed keys in the settings body parameter; unexpected outbound connections from the web server process to external IPs.
• Logs: Craft CMS or web server access logs showing POST requests to entry type override settings endpoints with anomalous or encoded settings parameters; PHP error logs referencing AttributeTypecastBehavior, ConsoleProcessus, or unexpected class instantiation.
• File System: New or modified files in the Craft CMS installation directory (e.g., web shells, cron scripts); unexpected files in /tmp or web-accessible directories created by the web server user.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget, python) with command-line arguments containing attacker-controlled strings.

The primary remediation is to update Craft CMS to version 5.9.11 or later, which adds a Component::cleanseConfig() call before passing parsed settings to Craft::configure() in EntryTypesController (Patch Commit). As a configuration-based workaround, setting allowAdminChanges to false in config/general.php prevents exploitation of this specific code path. Additionally, restrict control panel administrator access to the minimum necessary set of trusted users and enforce strong authentication (MFA) for admin accounts (Craft CMS Advisory).

The vulnerability was reported by researcher q1uf3ng and published by the Craft CMS security team on March 16, 2026. It was detected by Qualys (detection ID 531046) and covered by security aggregators including Red Packet Security and InfinitSec shortly after disclosure. Community reaction has been muted given the high privilege requirement, with most commentary noting this as a recurring pattern of incomplete patching in the Craft CMS behavior injection vulnerability series (Github Advisory).