Is CVE-2026-109308 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109308 being exploited in the wild.

How severe is CVE-2026-109308?

High severity, with a CVSS score of 8.8, published 12 October 2026.

Which products and versions are affected?

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14.

Is there a fix for CVE-2026-109308?

Yes: fixed in 4.18.7, 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109308 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109308?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109308: Craft CMS behavior injection RCE in AppController::actionCacheUpdates

CVE-2026-109308 · Severity: high · CVSS 8.8 · Published 2026-10-12

Craft CMS is a web content management platform used to build and manage websites. An authenticated user with updates permission can inject malicious code through the updates endpoint, allowing them to execute arbitrary commands on the server. This affects versions 4.0.0 through 4.18.6 and 5.0.0 through 5.10.13.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-109308 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109308 being exploited in the wild.
How severe is CVE-2026-109308?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14.
Is there a fix for CVE-2026-109308?: Yes: fixed in 4.18.7, 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109308 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109308?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.7, 5.10.14

Technical details

The AppController::actionCacheUpdates method passes unsanitized request parameters directly to UpdatesModel without calling Component::cleanseConfig(), allowing authenticated attackers to inject behavior and event-handler specifications. By supplying 'as' or 'on' keys with gadget chains like AttributeTypecastBehavior, attackers can achieve arbitrary object instantiation and code execution. Authentication is required but only needs the delegable performUpdates permission or Updates-utility access, not full admin privileges.

Affected products

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14

Timeline

2026-09-22: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.