CVE-2026-32263 in Craft
Summary
by MITRE • 03/16/2026
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/21/2026
This vulnerability exists in Craft CMS versions 5.6.0 through 5.9.10, specifically within the EntryTypesController.php file where a critical configuration injection flaw occurs. The vulnerability stems from the direct passing of an unvalidated $settings array from parse_str function to Craft::configure() method without proper sanitization through Component::cleanseConfig(). This creates an exploitable path for attackers to inject malicious Yii2 behavior and event handlers into the application's configuration. The flaw leverages the same attack vector previously documented in related advisories, making it a known pattern of configuration-based privilege escalation. The vulnerability requires specific conditions to be exploitable, including administrator permissions within the Craft control panel and the enableAdminChanges configuration flag being active. This represents a significant security risk as it allows attackers with administrative access to potentially escalate their privileges or manipulate application behavior through carefully crafted configuration parameters.
The technical implementation of this vulnerability exploits the underlying Yii2 framework's configuration system where keys prefixed with "as" or "on" are interpreted as behavior and event handler definitions respectively. When parse_str processes user-supplied input containing these special keys, the resulting array structure can be directly consumed by Craft::configure() which then passes it to Yii2's configuration engine. This bypasses normal input validation mechanisms and allows arbitrary code execution or configuration manipulation within the application context. The vulnerability is classified as a configuration injection flaw that enables attackers to inject malicious handlers that can intercept events, modify application behavior, or even execute arbitrary code within the application's execution context. This type of vulnerability falls under CWE-94, which covers "Improper Control of Generation of Code" and aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage.
The operational impact of this vulnerability is severe for Craft CMS installations that have administrative access enabled and where the enableAdminChanges flag is active. An attacker with control panel administrator privileges can leverage this flaw to inject malicious event handlers or behaviors that persist through application restarts, potentially allowing for long-term persistence within the system. The vulnerability essentially provides a backdoor mechanism for attackers to modify the application's runtime behavior without requiring additional privileges or complex exploitation techniques. This makes it particularly dangerous in environments where administrators have elevated access rights, as the attack surface expands significantly. The patch implemented in version 5.9.11 addresses this by introducing proper input sanitization through Component::cleanseConfig() which filters out dangerous configuration keys before they can be processed by the application's configuration system.
Organizations using Craft CMS should immediately upgrade to version 5.9.11 or later to remediate this vulnerability. Security teams should conduct thorough audits of their Craft CMS installations to verify that administrative access controls are properly configured and that the enableAdminChanges flag is disabled unless absolutely necessary. The vulnerability demonstrates the critical importance of input validation and configuration sanitization in web applications, particularly those built on frameworks like Yii2 where configuration injection attacks can have far-reaching consequences. System administrators should also implement monitoring for unusual configuration changes or behavior patterns that might indicate exploitation attempts. Additionally, implementing principle of least privilege access controls and regular security assessments will help mitigate the risk of exploitation even if the specific vulnerability is not immediately patched. This vulnerability serves as a reminder of the importance of validating all user-supplied data before processing it through framework configuration mechanisms and the potential for seemingly benign input processing functions to create security risks when used inappropriately.