What is the CVSS score of EUVD-2026-12504?

EUVD-2026-12504 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-12504?

A privilege escalation vulnerability exists in Craft CMS that allows authenticated administrators to inject malicious code through entry type settings, potentially compromising the entire content…. A patch is available.

How to fix or mitigate EUVD-2026-12504?

Within 24 hours: Identify all Craft CMS instances in your environment and verify current versions against CVE-2026-32263. Within 7 days: Apply the available vendor patch to all affected instances and test thoroughly in staging environments before production deployment. Within 30 days: Conduct access reviews to audit which users have administrator and entry type override permissions, and implement principle of least privilege restrictions.

PHP EUVD-2026-12504

| CVE-2026-32263 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-03-16 https://github.com/craftcms/cms

GHSA-qx2q-q59v-wf3j

Code Injection PHP

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 18:32 euvd

EUVD-2026-12504

Analysis Generated

Mar 16, 2026 - 18:32 vuln.today

Patch released

Mar 16, 2026 - 18:32 nvd

Patch available

CVE Published

Mar 16, 2026 - 18:12 nvd

HIGH 7.2

DescriptionGitHub Advisory

The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in EntryTypesController::actionApplyOverrideSettings().

In src/controllers/EntryTypesController.php lines 381-387:

php

$settingsStr = $this->request->getBodyParam('settings');
parse_str($settingsStr, $postedSettings);
$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');
$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));

if (!empty($settings)) {
    Craft::configure($entryType, $settings);

The $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via as or on prefixed keys, the same attack vector as the original advisory.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 5.9.11 to mitigate the issue.

AnalysisAI

Unsafe deserialization of untrusted user input in PHP Craft CMS allows authenticated high-privilege users to inject arbitrary Yii2 behaviors and event handlers, enabling remote code execution through the EntryTypesController. An incomplete prior patch for a similar vulnerability left the same dangerous pattern in place, permitting attackers with administrative access to manipulate application configuration and achieve full system compromise. A patch is available to properly sanitize configuration inputs before processing.

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication.

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.