CVE-2026-32264: 
PHP vulnerability analysis and mitigation

CVE-2026-32264 is an incomplete patch vulnerability in Craft CMS that allows authenticated administrators to achieve Remote Code Execution (RCE) via behavior injection in ElementIndexesController and FieldsController. It is a bypass of the prior fix for GHSA-7jx7-3846-m7w7 (commit 395c64f), which only patched src/services/Fields.php while leaving the same vulnerable pattern in two additional controllers. Affected versions are Craft CMS 4.0.0-RC1 through 4.17.4 and 5.0.0-RC1 through 5.9.10. Disclosed on March 16, 2026, it carries a CVSS v3.1 score of 7.2 (High) and a CVSS v4.0 score of 8.6 (High) (Github Advisory, Craft CMS Advisory).

The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection): user-supplied configuration data is passed to Yii2's Craft::createObject() without first being sanitized via Component::cleanseConfig(). In ElementIndexesController, the actionFilterHud() method processes a condition POST parameter that, when unsanitized, allows injection of Yii2 behavior configurations using the 'as <name>' key syntax. Similarly, FieldsController's actionRenderSettings() passes field $settings directly to Craft::configure() without cleansing. An attacker exploits Yii2's Component::__set() behavior attachment mechanism to inject a malicious AttributeTypecastBehavior, which triggers arbitrary command execution via call_user_func(['Psy\Readline\Hoa\ConsoleProcessus', 'execute'], $command) when model validation fires. Exploitation requires Craft control panel administrator credentials and the allowAdminChanges configuration setting to be enabled (Craft CMS Advisory, GHSA-7jx7-3846-m7w7).

Successful exploitation grants an authenticated attacker full remote code execution on the server running Craft CMS, resulting in high confidentiality, integrity, and availability impact on the vulnerable system. An attacker can exfiltrate sensitive data (database credentials, user data, environment secrets), modify or destroy application content, and disrupt service availability. The foothold gained on the server also enables lateral movement within the hosting environment or internal network (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for administrator-level control panel access and the allowAdminChanges setting being enabled, limiting the attacker pool to privileged insiders or accounts compromised via credential theft.

1. Obtain Admin Credentials: Acquire Craft CMS control panel administrator credentials through phishing, credential stuffing, or compromise of a privileged account.
2. Verify Preconditions: Confirm the target instance has allowAdminChanges set to true in its configuration (typically config/general.php).
3. Identify Vulnerable Endpoint: Target either ElementIndexesController's filter HUD action (/index.php?p=admin/actions/element-indexes/filter-hud) or FieldsController's render settings action (/index.php?p=admin/actions/fields/render-settings).
4. Craft Malicious Payload: Construct a POST request with a JSON body containing a Yii2 behavior injection key (e.g., 'as rce') pointing to AttributeTypecastBehavior configured with a typecastAfterValidate callback that invokes ['Psy\Readline\Hoa\ConsoleProcessus', 'execute'] with a desired shell command as the uid attribute value.
5. Submit Request: Send the crafted POST request to the vulnerable endpoint while authenticated as an administrator. Yii2's Component::__set() attaches the malicious behavior upon object creation.
6. Trigger Execution: When the controller calls validate() on the resulting model, EVENT_AFTER_VALIDATE fires, the AttributeTypecastBehavior executes typecastAttributes(), and the configured call_user_func invokes the shell command on the server.
7. Establish Persistence: Use the achieved RCE to deploy a web shell, establish a reverse shell, or exfiltrate credentials for further access (Craft CMS Advisory, GHSA-7jx7-3846-m7w7).

• Network: Unusual POST requests to /index.php?p=admin/actions/element-indexes/filter-hud or /index.php?p=admin/actions/fields/render-settings containing JSON bodies with 'as '-prefixed keys or references to AttributeTypecastBehavior or ConsoleProcessus; unexpected outbound connections from the web server process to external IPs.
• Logs: Craft CMS or web server access logs showing admin-authenticated POST requests to the above endpoints with abnormally large or structured JSON payloads; PHP error logs referencing Psy\Readline\Hoa\ConsoleProcessus or unexpected class instantiation.
• File System: New or modified files in the Craft CMS web root or storage directories (e.g., web shells with .php extensions); unexpected cron jobs or scripts created under the web server user's home or temp directories.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python, nc) with command-line arguments referencing external hosts or encoded payloads.

Update Craft CMS to version 4.17.5 (for the 4.x branch) or 5.9.11 (for the 5.x branch), which apply Component::cleanseConfig() to user-supplied input in both ElementIndexesController and FieldsController (commits dfec463 and 78d181e) (Craft CMS Advisory). As an interim workaround, set allowAdminChanges to false in config/general.php for environments where admin configuration changes are not required, which blocks the exploitation precondition. Additionally, restrict control panel access to trusted IP ranges and enforce strong, unique credentials with MFA for all administrator accounts.

The advisory was published by Craft CMS maintainer angrybrad on March 16, 2026, and promptly indexed by security aggregators including Qualys (detection ID 531045), INCIBE-CERT, and RedPacket Security (Github Advisory). Community reaction has been moderate, consistent with the pattern of incomplete patch disclosures in CMS platforms. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability feed aggregation.