Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Craft CMS admin can execute code via update request

CVE-2026-109308 · published 4 days ago
Summary

In certain versions of Craft CMS, a logged‑in user who can access the control panel and perform updates can send a specially crafted request that tricks the system into running any code they want. This happens because the request data isn’t properly cleaned before being processed. Upgrade to the latest Craft CMS release or apply the vendor’s patch to stop this behavior.

Original advisory text
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109308 · NVD
CVE-2026-109308 · OSV
GHSA-5m2g-hhqr-84pc · GHSA
Track software like this
Free during beta