CakePHP CVE-2026-119418

Exploitation requires the target application to forward unvalidated user input into a CakePHP window-function OVER clause - specifically into WindowExpression::range() or frame() as frame offsets (startOffset/endOffset) or directions (startDirection/endDirection), or into related partition/orderBy/function-name strings. This is a non-default coding pattern: a stock CakePHP install is not exploitable unless developer code builds windowed queries from request data. No framework-level authentication is required of the attacker (PR:N), and no user interaction is needed (UI:N), but the attack requirement (AT:P) and high complexity (AC:H) reflect that the specific vulnerable code path and input forwarding must be present. The only complete fix stated by the evidence is updating past 5.4.3 to a version containing the ensureSimpleString() validation.

This is a genuinely high-severity SQL injection (CWE-89) carrying a CVSS 4.0 base score of 9.2 with full VC:H/VI:H/VA:H impact, and the vuln.today Decision label is act_now, so it should be treated as urgent rather than a high-score-but-low-risk theoretical issue. However, the signals are not uniformly alarming: the 4.0 vector itself encodes friction via AC:H and AT:P (attack requirements present), reflecting that exploitation is NOT a default-configuration remote hit but depends on the application forwarding unvalidated user input into the window-function OVER clause (WindowExpression::range()/frame() offsets and directions). PR:N confirms no framework-level authentication is required of the attacker. No EPSS score and no CISA KEV entry are present in the input, so there is no quantified exploitation-probability signal and no evidence of active exploitation; the urgency here derives from the act_now label, the critical impact, the confirmed vendor patch, and VulnCheck's reporting rather than from observed in-the-wild activity. A public research/PoC reference exists (abraxaslabs.tech and the VulnCheck advisory) but the input does not confirm it as working exploit code. Net: prioritize patching for any CakePHP application that builds window queries from user input, but recognize the real-world blast radius is bounded by that specific coding pattern.

An application uses CakePHP's query builder to construct a windowed query (OVER clause) and passes user-supplied values into WindowExpression::range() or frame() as frame offsets or directions. An attacker submits crafted frame-offset or direction values (e.g. containing 'OR 1=1'-style payloads) that are concatenated unvalidated into the generated SQL, causing arbitrary SQL to execute with the database connection's privileges. A public PoC/research reference exists but is not verified as working exploit code in the provided input.