Craft CMS: Remote code execution via behavior injection in actionCacheUpdates

Summary

Craft CMS, a PHP content management system, contains a code injection flaw in the update cache action (actionCacheUpdates). An authenticated control panel user with the performUpdates permission or access to the Updates utility can inject behaviors and event handlers, which can lead to arbitrary code execution on the server. Administrator rights are not required, but a valid control panel account is needed.

Affected

• Craft CMS 4.0.0 to before 4.18.7
• Craft CMS 5.0.0 to before 5.10.14

Fixed in

• Craft CMS 4.18.7 or later (4.x line)
• Craft CMS 5.10.14 or later (5.x line)

Workaround

Unknown. The vendor does not describe a workaround.

• Limit the performUpdates permission and Updates utility access to trusted users.
• Restrict control panel access to trusted networks or VPN.

Exploitation

• No known exploitation in the wild according to the sources reviewed.
• Not listed in CISA KEV. CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept found. The advisory describes the mechanism.

Our recommendation

• Inventory Craft installations and check composer.lock for craftcms/cms versions below 4.18.7 or 5.10.14.
• Upgrade affected installations promptly after testing.
• Review accounts with performUpdates or Updates utility access and remove unneeded rights.
• Restrict control panel access to trusted networks where possible.
• Check logs for unusual requests to the update cache action.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-5m2g-hhqr-84pc github.com
• VulnCheck advisory: Craft CMS RCE via actionCacheUpdates www.vulncheck.com
• Craft CMS 5.10.14 release github.com
• VulDB entry 417116 vuldb.com
• HOL Guard CVE summary hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:48.