Advisory · CVE-2026-109308
Craft CMS cache-updates action allows code execution
Authenticated Craft CMS control panel users with the performUpdates permission can inject behavior configuration through the raw updates parameter of the cache-updates action and execute arbitrary code. Fixed in 4.18.7 and 5.10.14.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-109308
CWE-94 - Action timing
- Immediate
Explain it like I’m five
A settings form is supposed to accept only a short list of safe choices. Instead it accepts handwritten instructions for how the machine itself should behave, and the machine follows them.
- 01Control panel access
An attacker signs in with the performUpdates permission or access to the Updates utility.
- 02Crafted parameter
The attacker sends a raw updates parameter to the cache-updates action, including as or on keys.
- 03No cleansing
The value reaches the updates model without the configuration cleansing step that would strip behavior definitions.
- 04Code executes
A gadget such as an attribute typecast behavior is instantiated, giving arbitrary code execution.
What happened
The Craft CMS security advisory for CVE-2026-109308 covers Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14, and rates the flaw CVSS 3.1 8.8.
The cache-updates action passes the raw updates request parameter to the updates model without the cleansing step normally applied to configuration arrays. An authenticated control panel user with the performUpdates permission, or access to the Updates utility, can supply as or on keys, for example an attribute typecast behavior gadget, to execute arbitrary code.
Per the advisory record, 4.18.7 and 5.10.14 are the fixed releases for the two affected lines.
What to do
- Inventory Craft CMS sites on the 4.x and 5.x lines and check each version.
- Upgrade 4.x sites to 4.18.7 or later and 5.x sites to 5.10.14 or later.
- Review which accounts hold the performUpdates permission or Updates utility access.
- Review control panel request logs for cache-updates calls carrying unusual updates payloads.
- Inspect the server for unexpected files or processes if any suspicious call is found.
- Confirm the deployed version after upgrading.
Management note
Update permissions are often handed to whoever keeps a site current, including external contractors. On an unpatched site that permission is effectively code execution, so the account list matters as much as the patch.