PT-2026-25804 · Craft Cms · Craft Cms

Q1Uf3Ng · Published 2026-02-09 · Updated 2026-03-25 · CVE-2026-32263

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.6.0 through 5.9.10

Description Craft CMS is a content management system (CMS). A flaw exists in the way settings are processed, specifically within the EntryTypesController.php file. The $settings array, derived from parse str, is directly passed to Craft::configure() without proper sanitization using Component::cleanseConfig(). This allows for the injection of Yii2 behavior and event handlers through keys prefixed with 'as' or 'on', mirroring a previously identified attack vector. Successful exploitation requires administrator permissions within the Craft control panel and the allowAdminChanges setting to be enabled. An attacker can leverage this to achieve Remote Code Execution (RCE) using the same gadget chain as the original advisory.

Recommendations Versions 5.6.0 through 5.9.10 should be updated to version 5.9.11.

Exploit

Fix

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-32263

GHSA-7JX7-3846-M7W7

GHSA-QX2Q-Q59V-WF3J

Affected Products

Craft Cms

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32263.json · Exploit
• https://github.com/craftcms/cms/commit/d37389dbffafa565143be40a2ab1e1db22a863f7 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-qx2q-q59v-wf3j · Vendor Advisory
• https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25498 · Security Note
• https://osv.dev/vulnerability/GHSA-qx2q-q59v-wf3j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32263 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jx7-3846-m7w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32263 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748 · Note
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033763827846717784 · Twitter Post