CVE-2026-109308

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13

Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because the updates request parameter in the AppController::actionCacheUpdates function is passed to UpdatesModel without being processed by Component::cleanseConfig(). This allows for behavior and event-handler injection by supplying as or on keys, such as an AttributeTypecastBehavior gadget.

Recommendations Update Craft CMS to version 4.18.7 or later. Update Craft CMS to version 5.10.14 or later.