Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-79752CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Critical 9.2

In plain English

A critical-severity SQL injection in cakephp from cakephp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.6%top 50.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistcakephp/cakephp5.3.7GHSA-vjqc-q4mp-2rvf
Packagistcakephp/cakephp4.5.12GHSA-vjqc-q4mp-2rvf
Packagistcakephp/cakephp4.6.5GHSA-vjqc-q4mp-2rvf
Packagistcakephp/cakephp5.1.9GHSA-vjqc-q4mp-2rvf
Packagistcakephp/cakephp5.2.14GHSA-vjqc-q4mp-2rvf
Packagistcakephp/database5.3.7GHSA-vjqc-q4mp-2rvf
Packagistcakephp/database4.5.12GHSA-vjqc-q4mp-2rvf
Packagistcakephp/database4.6.5GHSA-vjqc-q4mp-2rvf
Packagistcakephp/database5.1.9GHSA-vjqc-q4mp-2rvf
Packagistcakephp/database5.2.14GHSA-vjqc-q4mp-2rvf
Ubuntu:22.04:LTScakephpno fix listedUBUNTU-CVE-2026-79752

Affected products (as reported)

VendorProductVersions
cakephp cakephp < 4.5.12>= 4.6.0, < 4.6.5>= 5.0.0, < 5.1.9>= 5.2.0, < 5.2.14>= 5.3.0, < 5.3.7

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References