8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32263

CVE-2026-32263: Craft CMS vulnerable to behavior injection RCE via EntryTypesController

The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in EntryTypesController::actionApplyOverrideSettings().

In src/controllers/EntryTypesController.php lines 381-387:

$settingsStr = $this->request->getBodyParam('settings');
parse_str($settingsStr, $postedSettings);
$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');
$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));

if (!empty($settings)) {
    Craft::configure($entryType, $settings);

The $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via as or on prefixed keys, the same attack vector as the original advisory.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 5.9.11 to mitigate the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32263

CVE-2026-32263:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.6.0, <= 5.9.10	5.9.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a remote code execution (RCE) in Craft CMS, specifically in the EntryTypesController. The analysis of the provided patch d37389dbffafa565143be40a2ab1e1db22a863f7 confirms that the actionApplyOverrideSettings method was the source of the vulnerability. The patch introduces the Component::cleanseConfig() function to sanitize the user-provided settings before they are passed to the Craft::configure() method. This prevents the injection of malicious Yii2 behaviors and event handlers, which was the root cause of the RCE. The vulnerability was a bypass of a previous fix for a similar issue, indicating that the same vulnerable pattern existed in multiple places in the codebase.

Vulnerable functions

EntryTypesController::actionApplyOverrideSettings

src/controllers/EntryTypesController.php

The `actionApplyOverrideSettings` function in `src/controllers/EntryTypesController.php` was vulnerable to a behavior injection leading to Remote Code Execution (RCE). The vulnerability existed because user-supplied settings were passed to the `Craft::configure()` method without proper sanitization. An attacker could provide specially crafted settings with `as ` or `on ` prefixes to inject malicious Yii2 behaviors or event handlers. The patch mitigates this by adding a call to `Component::cleanseConfig()` to sanitize the settings before they are used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.