Craft CMS CVE-2026-109308

Exploitation requires an authenticated Craft CMS control panel user holding either the performUpdates permission or access to the Updates utility; without such an account the vulnerable AppController::actionCacheUpdates endpoint cannot be reached. Given that prerequisite, exploitation is straightforward and remote over the network with no user interaction: the attacker supplies an 'as' or 'on' key (e.g., an AttributeTypecastBehavior gadget) in the raw 'updates' request parameter, which reaches UpdatesModel unsanitized because Component::cleanseConfig() is not applied. The limiting factor is therefore the privileged-account requirement (PR:L), which confines realistic risk to malicious insiders, over-provisioned admin accounts, or scenarios where a control-panel credential has already been compromised. Affected deployments are Craft CMS 4.0.0-4.18.6 and 5.0.0-5.10.13.

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and is internally consistent with the description: network-reachable, low complexity, no user interaction, and crucially PR:L - exploitation requires an authenticated control panel account. The high triple-impact (VC:H/VI:H/VA:H with SC/SI/SA:N) correctly reflects CWE-94 code injection yielding arbitrary PHP execution on the host without a scope change to a separate system. The mitigating factor that tempers raw severity is the privilege requirement: the attacker must already hold a control panel account with either the performUpdates permission or Updates-utility access, so this is a privilege-escalation-to-RCE path for insiders or an attacker who has compromised a mid-tier admin credential, not an anonymous internet-facing RCE. No EPSS score, KEV listing, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis - the risk is driven by severity and ease of exploitation once authenticated rather than by observed in-the-wild activity. Signals are consistent (no conflicts between CVSS and description); the main missing data is any exploitation-probability metric.

An attacker who has obtained a Craft CMS control panel account carrying the performUpdates permission (or Updates-utility access) - for example via phishing a staff member or exploiting a weaker credential - navigates to the cache-updates functionality and submits a crafted 'updates' parameter containing an 'as' or 'on' key referencing a Yii gadget such as AttributeTypecastBehavior. Because the raw parameter is passed to UpdatesModel without Component::cleanseConfig(), the injected behavior/event handler is instantiated and executes arbitrary PHP code on the server. No public exploit code was identified in the provided intelligence, but the technique relies on well-documented Yii behavior-injection gadgets.