CVE-2026-109308: Craft CMS RCE Vulnerability

CVE-2026-109308 Overview

CVE-2026-109308 is a code injection vulnerability [CWE-94] in Craft CMS affecting versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14. The flaw resides in AppController::actionCacheUpdates, which passes the raw updates request parameter to UpdatesModel without invoking Component::cleanseConfig(). Authenticated control panel users with the performUpdates permission or Updates-utility access can inject as or on keys to attach malicious behaviors or event handlers. Supplying a Yii2 AttributeTypecastBehavior gadget allows arbitrary code execution on the server.

Critical Impact

Authenticated control panel users can achieve remote code execution on Craft CMS servers through behavior and event-handler injection in the cache updates endpoint.

Affected Products

• Craft CMS 4.0.0 through 4.18.6
• Craft CMS 5.0.0 through 5.10.13
• Installations exposing the control panel with the Updates utility enabled

Discovery Timeline

• 2026-10-12 - CVE-2026-109308 published to the National Vulnerability Database
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109308

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-supplied configuration data in the Craft CMS control panel. The actionCacheUpdates method in AppController accepts an updates parameter from the HTTP request and forwards it directly to UpdatesModel. Craft CMS normally sanitizes component configuration arrays through Component::cleanseConfig(), which strips the reserved as (behaviors) and on (event handlers) keys. The missing sanitization call on this code path breaks that trust boundary.

Because UpdatesModel extends a Yii2 configurable component, any as * key in the configuration array is interpreted as a behavior attachment. An attacker can attach the built-in AttributeTypecastBehavior gadget and set its typecastAfterFind or related callable properties to arbitrary PHP functions. When the model triggers the associated event, the callable executes with web server privileges.

Root Cause

The root cause is improper neutralization of code elements [CWE-94]. The controller trusts request-supplied array data as safe configuration without filtering reserved Yii2 keys. The absence of Component::cleanseConfig() on the updates parameter leaves the behavior and event injection surface exposed.

Attack Vector

Exploitation requires an authenticated session with either the performUpdates permission or access to the Updates utility within the control panel. The attacker sends a crafted POST request to the cache updates endpoint containing an updates array with an as key referencing a Yii2 behavior class and attacker-controlled callable properties. Triggering the behavior results in arbitrary PHP code execution. The attack is network-reachable wherever the Craft CMS control panel is exposed. Refer to the GitHub Security Advisory GHSA-5m2g-hhqr-84pc and the VulnCheck Advisory Craft CMS RCE for technical details.

Detection Methods for CVE-2026-109308

Indicators of Compromise

• POST requests to the Craft CMS cache updates action containing updates[as or updates[on substrings in the request body
• Unexpected PHP processes spawned by the web server user following control panel activity
• New or modified files under the Craft CMS storage/ or web-accessible directories after an authenticated session
• Outbound network connections from the PHP-FPM or web worker process to unknown destinations

Detection Strategies

• Inspect web server access logs for requests to actions/app/cache-updates with abnormal parameter structures containing as or on keys
• Hunt for Yii2 behavior class names such as AttributeTypecastBehavior appearing in HTTP request bodies
• Correlate authenticated control panel sessions with subsequent command execution events on the host

Monitoring Recommendations

• Enable Craft CMS audit logging and forward control panel action events to a centralized log platform
• Monitor process creation telemetry on web servers for child processes of php-fpm, apache2, or nginx workers
• Alert on changes to Craft CMS plugin, module, or template directories outside scheduled deployment windows

How to Mitigate CVE-2026-109308

Immediate Actions Required

• Upgrade Craft CMS to version 4.18.7 or 5.10.14 or later immediately
• Audit control panel accounts and revoke the performUpdates permission from users who do not require it
• Review web server and application logs for prior requests to the cache updates endpoint containing as or on parameters
• Restrict control panel network exposure to trusted IP ranges or VPN access

Patch Information

Craft CMS released fixes in versions 4.18.7 and 5.10.14. The patch applies Component::cleanseConfig() to the updates parameter inside AppController::actionCacheUpdates, stripping the reserved as and on configuration keys before instantiating UpdatesModel. See the GitHub Security Advisory GHSA-5m2g-hhqr-84pc for release details.

Workarounds

• Block external access to the Craft CMS control panel via web application firewall or reverse proxy rules
• Add WAF signatures that reject requests containing updates[as] or updates[on] parameter patterns
• Temporarily disable the Updates utility and remove the performUpdates permission from non-administrative roles until patches are applied

# Example nginx rule to block exploitation attempts
location ~ ^/actions/app/cache-updates {
    if ($request_body ~* "updates(\[|%5B)(as|on)") {
        return 403;
    }
}