Craft CMS 4.0.0 through 4.18.6 and 5.0.0 through 5.10.13 contain a flaw that allows an authenticated control panel user with update permissions to inject arbitrary code by sending a specially crafted 'updates' request to the actionCacheUpdates endpoint. The request bypasses the framework’s configuration cleansing routine, enabling the injection of behavior and event‑handler definitions such as AttributeTypecastBehavior gadgets that execute under the web application’s privileges.

Affected systems include Craft CMS versions before 4.18.7 in the 4.x branch and before 5.10.14 in the 5.x branch. Only installations that have not applied the published releases remain vulnerable; earlier releases prior to 4.0.0 or later patched releases are unaffected.

The vulnerability carries a CVSS v3.1 score of 8.7 (High), the EPSS score is currently unavailable, and the issue is not included in CISA’s KEV catalog, suggesting no public exploits have been confirmed. However, because the attack requires legitimate update privileges, the risk remains significant in environments where many users hold performUpdates rights or where the control panel update feature is exposed to a broader audience.