CVE-2026-109308

Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 are vulnerable to Remote Code Execution (RCE) via behavior injection. The flaw exists because the AppController::actionCacheUpdates function passes the raw updates request parameter to UpdatesModel without calling Component::cleanseC...

PT-2026-110725

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13 Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because th...