CVE-2026-109308 [HIGH] – Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw ‘updates’ request pa

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw ‘updates’ request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply ‘as’ or ‘on’ keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.