EUVD-2026-276369

fkie_cve-2026-32263

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.

GHSA-qx2q-q59v-wf3j — Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Affected: Packagist: craftcms/cms

The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `EntryTypesController::actionApplyOverrideSettings()`.

In `src/controllers/EntryTypesController.php` lines 381-387:

```php $settingsStr = $this->request->getBodyParam('settings'); parse_str($settingsStr, $postedSettings); $settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace'); $settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));

if (!empty($settings)) { Craft::configure($entryType, $settings); ```

The `$settings` array from `parse_str` is passed directly to `Craft::configure()` without `Component::cleanseConfig()`. This allows injecting Yii2 behavior/event handlers via `as ` or `on ` prefixed keys, the same attack vector as the original advisory.

You need Craft control panel administrator permissions, and `allowAdminChanges` must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 5.9.11 to mitigate the issue.

Most recent entries from all

EUVD-2026-276369

fkie_cve-2026-32263

GHSA-qx2q-q59v-wf3j — Craft CMS vulnerable to behavior injection RCE via EntryTypesController