CVE-2026-77635

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

CakePHP versions 2.x and 3.x before 3.1.5 may allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

In CakePHP, the FunctionsBuilder methods (cast, extract, datePart, dateAdd) allow SQL injection by improperly handling user-controlled input. Untrusted data is incorporated into SQL syntax without proper escaping, potentially enabling attackers to execute arbitrary queries.

The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist: C0 control characters (CR/LF) cause PHP to drop the entire header, leading to inline rendering and stored XSS; a double-quote character terminates the quoted-string early, allowing injection of additional Content-Disposition parameters.

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers.

In CakePHP, versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, the View::_getElementFileName() function does not check if the resolved element path is within the allowed application/plugin view template paths. This weakness can be exploited to include other PHP files on the server using specifically crafted user-supplied data.