CVE-2026-109308: Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection

Q: Who can exploit this issue?

An authenticated Craft control panel user must have either the performUpdates permission or access to the Updates utility. Unauthenticated users are not described as able to exploit it.

Q: What level of access does successful exploitation provide?

A permitted attacker can inject behavior or event-handler configuration through the updates request parameter and execute arbitrary code. The reported impact includes high confidentiality, integrity, and availability effects.

Q: Which deployments are affected?

Affected releases are Craft CMS 4.0.0 through before 4.18.7 and 5.0.0 through before 5.10.14. The issue is reachable through the cache-updates action for users who have the required update-related access.

Q: What can be done if patching cannot happen immediately?

Remove or restrict performUpdates permission and Updates utility access for control panel accounts that do not strictly require it. This reduces exposure because exploitation requires one of those access paths.

Published Oct 12, 2026

Updated

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.

Affected Software

1 affected component

Craft Craft CMS>=4.0.0<4.18.7, >=5.0.0<5.10.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 4.18.7
Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 5.10.14

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Craft control panel user must have either the performUpdates permission or access to the Updates utility. Unauthenticated users are not described as able to exploit it.

What level of access does successful exploitation provide?

A permitted attacker can inject behavior or event-handler configuration through the updates request parameter and execute arbitrary code. The reported impact includes high confidentiality, integrity, and availability effects.

Which deployments are affected?

Affected releases are Craft CMS 4.0.0 through before 4.18.7 and 5.0.0 through before 5.10.14. The issue is reachable through the cache-updates action for users who have the required update-related access.

What can be done if patching cannot happen immediately?

Remove or restrict performUpdates permission and Updates utility access for control panel accounts that do not strictly require it. This reduces exposure because exploitation requires one of those access paths.

CVE-2026-109308: Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access does successful exploitation provide?

Which deployments are affected?

What can be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access does successful exploitation provide?

Which deployments are affected?

What can be done if patching cannot happen immediately?