Skip to content

CVE record · 1 source

CVE-2026-109308

CVSS 8.8

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to…

Vendor: Craft CMS
Product: Craft CMS
CVSS: 8.8
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

15

CVE NVD 19d ago

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to…

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler…

CVSS 8.8 CVE-2026-109308 Craft CMS