The vulnerability lies in Craft CMS's EntryTypesController where an array of settings parsed from a query string is passed directly to Craft::configure without cleansing. This allows a malicious actor to inject Yii2 behavior and event handler definitions through keys prefixed with "as" or "on", effectively enabling code execution. Comprised of a CWE-470 flaw, the impact is Remote Code Execution when the attacker can supply input that is processed by the controller.

The flaw affects Craft CMS versions from 5.6.0 up to but not including 5.9.11. The affected product series is craftcms:cms, as listed in the vendor data. Any site running a version within this range is vulnerable.

The CVSS score of 8.6 indicates a high severity. The EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that Craft control panel administrator permissions are enabled and the allowAdminChanges setting is true, allowing the attack to occur through the control panel interface. If those conditions are met, an attacker could achieve complete code execution on the affected system.