CVE-2026-79752
Severity not reportedCakePHP is a rapid development framework for PHP.
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0 security-advisories@github.com
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e security-advisories@github.com
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676 security-advisories@github.com
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d security-advisories@github.com
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45 security-advisories@github.com
- https://github.com/cakephp/cakephp/pull/19520 security-advisories@github.com
- https://github.com/cakephp/cakephp/pull/19528 security-advisories@github.com
- https://github.com/cakephp/cakephp/releases/tag/4.5.12 security-advisories@github.com
- https://github.com/cakephp/cakephp/releases/tag/4.6.5 security-advisories@github.com
- https://github.com/cakephp/cakephp/releases/tag/5.1.9 security-advisories@github.com
- https://github.com/cakephp/cakephp/releases/tag/5.2.14 security-advisories@github.com
- https://github.com/cakephp/cakephp/releases/tag/5.3.7 security-advisories@github.com
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf security-advisories@github.com