AIKIDO-2026-772191

craftcms/cms is vulnerable to Remote Code Execution

Remote Code ExecutionGHSA-5m2g-hhqr-84pc Published Yesterday

High Risk

This Affects:

craftcms/cms

3.3.16 - 4.18.6

Fixed in 4.18.7

5.0.0 - 5.10.13.2

Fixed in 5.10.14

Are you affected? Scan for Free

TL;DR

Craft CMS 4.18.7 and 5.10.14 fix two distinct security issues. GHSA-5m2g-hhqr-84pc affected the cache-updates endpoint, which passed request-controlled update data into UpdatesModel construction without cleansing Yii behavior and event configuration keys; an authenticated user with Updates utility access could use that path to execute code as the PHP web user. GHSA-j5wg-m2pr-35qc affected the Twig create() function, whose denylist omitted DOM, XML, HTTP, database, and reflection classes usable as server-side data-read gadgets when untrusted values reached a non-sandboxed object template. A deployment within a vulnerable range may be exposed to either issue depending on its update permissions and template data flow.

Who does this affect?

You are affected if you are using a version that falls within a vulnerable range and authenticated users can access the Updates utility or untrusted class names or parameters can reach create() in a non-sandboxed object template.