CVE-2026-109308 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations should assess exposure and prioritize patching. This includes administrators, security teams, and developers who manage or maintain Craft CMS installations. Additionally, operators and platform administrators should be aware of the potential risks and take steps to restrict access to the control panel and monitor for suspicious activity.

Why it matters

CVE-2026-109308 is a high-severity vulnerability in Craft CMS, allowing authenticated users to inject malicious behavior and execute arbitrary code. Defenders should prioritize patching and restrict access to the control panel.

• Authenticated users can execute arbitrary code
• Defenders must patch to prevent code execution
• Verify Craft CMS versions and restrict access to the control panel

Technical summary

The vulnerability is caused by the lack of input validation in the actionCacheUpdates method, allowing attackers to inject malicious behavior and execute arbitrary code. This issue arises from the fact that Craft CMS passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without proper cleansing through Component::cleanseConfig(). As a result, attackers can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code. The vulnerability has been confirmed to affect Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14.

Defensive priority

Defenders should prioritize patching this vulnerability, as it allows authenticated users to execute arbitrary code.

Recommended defensive actions

• Patch Craft CMS to version 4.18.7 or later
• Patch Craft CMS to version 5.10.14 or later
• Restrict access to the control panel to trusted users
• Monitor for suspicious activity in the control panel
• Verify Craft CMS versions and restrict access to the control panel
• Implement additional monitoring and logging to detect potential exploitation attempts
• Conduct a thorough review of control panel access and permissions to minimize exposure

Evidence notes

The vulnerability is caused by the lack of input validation in the actionCacheUpdates method, allowing attackers to inject malicious behavior and execute arbitrary code. This issue arises from the fact that Craft CMS passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without proper cleansing through Component::cleanseConfig(). As a result, attackers can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code. The vulnerability has been confirmed to 4

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.