{"metadata": {"vulnerability": "cve-2026-109308", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-22T00:00:00Z", "date_only": false, "value": "2026-09-22T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109308", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:14:27.021Z", "date_only": false, "value": "2026-10-12T14:14:27.021Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109308", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:04.666Z", "date_only": false, "value": "2026-10-12T16:05:04.666Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109308", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:04.666Z", "date_only": false, "value": "2026-10-12T16:05:04.666Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109308", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:14:35.171Z", "date_only": false, "value": "2026-10-12T17:14:35.171771Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429061152171520", "record": "CVE-2026-109308", "field": "creation_timestamp", "uuid": "5645a938-dbb5-4039-8729-17293bcbbf18", "content": "CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109308https://github.com/craftcms/cms/security/advisories/GHSA-5m2g-hhqr-84pchttps://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.7-and-5.0.0-before-5.10.14-rce-via-actioncacheupdates-behavior-injection#craftcms #cms#CVE_2026_109308#bot", "url": "https://infosec.exchange/users/cve/statuses/117429061152171520"}, {"timestamp": "2026-10-12T17:17:25Z", "date_only": false, "value": "2026-10-12T17:17:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R8MR-VM79-XXH4", "record": "GHSA-R8MR-VM79-XXH4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:25.227Z", "date_only": false, "value": "2026-10-12T17:17:25.227", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109308", "record": "FKIE_CVE-2026-109308", "field": "published"}, {"timestamp": "2026-10-12T18:31:47Z", "date_only": false, "value": "2026-10-12T18:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R8MR-VM79-XXH4", "record": "GHSA-R8MR-VM79-XXH4", "field": "published"}, {"timestamp": "2026-10-12T18:31:47Z", "date_only": false, "value": "2026-10-12T18:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R8MR-VM79-XXH4", "record": "GHSA-R8MR-VM79-XXH4", "field": "modified"}, {"timestamp": "2026-10-13T04:40:05.653Z", "date_only": false, "value": "2026-10-13T04:40:05.653531Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq7ocyn2s2l", "record": "CVE-2026-109308", "field": "creation_timestamp", "uuid": "a1197d92-07cf-4ad6-8437-1cd2e7ac57bf", "content": "CVE-2026-109308\nVersions of Craft CMS 4 up to 4.18.6 and 5 up to 5.10.13 do not properly filter a special update request. An administrator with permission to run updates could send crafted data that causes the system to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq7ocyn2s2l"}, {"timestamp": "2026-10-13T15:46:56.285Z", "date_only": false, "value": "2026-10-13T15:46:56.285080Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109308", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T15:46:56.285Z", "date_only": false, "value": "2026-10-13T15:46:56.285080Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109308", "record": "FKIE_CVE-2026-109308", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T15:47:12.028Z", "date_only": false, "value": "2026-10-13T15:47:12.028Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109308", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:47:12.028Z", "date_only": false, "value": "2026-10-13T15:47:12.028Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109308", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:15:07.947Z", "date_only": false, "value": "2026-10-16T19:15:07.947", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109308", "record": "FKIE_CVE-2026-109308", "field": "lastModified"}]}