CVE-2026-32263: craftcms cms Unsafe Reflection

Vulnerability summary

CVE-2026-32263 is a high (CVSS 8.6) Unsafe Reflection vulnerability in craftcms cms. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities.

Timeline

1. 16-03-2026
   PublishedVulnerability first disclosed.
2. 17-03-2026
   Last modifiedVulnerability information updated.

Description

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.

• CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.