CVE-2026-79752
CriticalCVSS 9.2Summary
In CakePHP, the FunctionsBuilder methods (cast, extract, datePart, dateAdd) allow SQL injection by improperly handling user-controlled input. Untrusted data is incorporated into SQL syntax without proper escaping, potentially enabling attackers to execute arbitrary queries.
Risk Assessment
Risk of SQL injection, potentially leading to unauthorized database access, data modification, or deletion.
Recommendation
Update CakePHP to one of the fixed versions (4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7) to eliminate the vulnerability.
Other vulnerabilities in CakePHP
See all- CVE-2016-4793High
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
- CVE-2015-8379High
CakePHP versions 2.x and 3.x before 3.1.5 may allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- CVE-2026-77635Critical
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter.
- CVE-2026-77634High
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers.
- CVE-2026-48820Medium
In CakePHP, versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, the View::_getElementFileName() function does not check if the resolved element path is within the allowed application/plugin view template paths. This weakness can be exploited to include other PHP files on the server using specifically crafted user-supplied data.
Original NVD description (English source)
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.