High severity8.8NVD Advisory· Published Oct 12, 2026
CVE-2026-109308
CVE-2026-109308
Description
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.