CVE-2026-48820
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In CakePHP, versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, the View::_getElementFileName() function does not check if the resolved element path is within the allowed application/plugin view template paths. This weakness can be exploited to include other PHP files on the server using specifically crafted user-supplied data.
Risk Assessment
This vulnerability may lead to unauthorized access to PHP files on the server, posing a serious threat to the security of the application and user data.
Recommendation
It is recommended to upgrade to versions 5.3.6, 5.2.13, 5.1.7, 4.6.4, or 4.5.11, which contain fixes that address this vulnerability.
Other vulnerabilities in CakePHP
See all- CVE-2016-4793High
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
- CVE-2015-8379High
CakePHP versions 2.x and 3.x before 3.1.5 may allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- CVE-2026-79752Critical
In CakePHP, the FunctionsBuilder methods (cast, extract, datePart, dateAdd) allow SQL injection by improperly handling user-controlled input. Untrusted data is incorporated into SQL syntax without proper escaping, potentially enabling attackers to execute arbitrary queries.
- CVE-2026-77635Critical
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter.
- CVE-2026-106512High
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist: C0 control characters (CR/LF) cause PHP to drop the entire header, leading to inline rendering and stored XSS; a double-quote character terminates the quoted-string early, allowing injection of additional Content-Disposition parameters.
- CVE-2026-77634High
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers.
Original NVD description (English source)
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS