Download Latest Version 4.18.0.1 source code.tar.gz (8.3 MB)
Email in envelope

Get an email when there's a new version of Craft CMS

Home / 4.18.0
Name Modified Size InfoDownloads / Week
Parent folder
CraftCMS-4.18.0.zip 2026-05-13 26.0 MB
0
4.18.0 source code.tar.gz 2026-05-13 8.3 MB
0
4.18.0 source code.zip 2026-05-13 9.5 MB
0
README.md 2026-05-13 1.1 kB
0
Totals: 4 Items   43.8 MB 0

Development

  • The |default Twig filter and is empty Twig test now treat all yii\base\Model instances as not empty. (#18727)
  • Added craft\filters\SecFetchSiteFilter for request origin verification. (#18641)
  • dataUrl() is no longer allowed in sandboxed Twig environments by default.

Extensibility

  • Removed craft\controllers\AppController::actionResourceJs(). (#18559)

System

  • Cross-domain script tags added by JavaScript are now loaded directly, rather than via a proxy. (#18559)
  • Updated the built-in composer.phar to 2.9.8. (#18761)
  • Fixed a moderate-severity JavaScript injection vulnerability. (GHSA-c55v-343g-5xff)
  • Fixed a moderate-severity path traversal vulnerability. (GHSA-287w-mxq6-x2cp)
Source: README.md, updated 2026-05-13