CakePHP CVE-2026-119419

Exploitation requires the application to pass an attacker-controlled string as the collation argument to the StringExpression or IdentifierExpression constructor, or to setCollation(). Because CakePHP emits the COLLATE clause unquoted, a collation value containing SQL breaks out of the clause and injects arbitrary SQL, affecting every database driver within the connection's privileges (CWE-89). LIMITING FACTORS: this is not remote-unauthenticated against a default configuration - collation values are rarely derived from user input, so the app must specifically route untrusted data into collation (reflected in the vector's AC:H/AT:P). No user interaction is needed, and no authentication is required at the library boundary (PR:N), but the precondition of attacker-controlled collation is the real gate on exploitability. Only versions ≤5.4.3 are affected.

Signals point in two directions and must be reconciled. The vendor CVSS 4.0 vector (AV:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.2 critical) and the vuln.today 'act_now' decision label argue for urgent remediation, and CWE-89 SQL injection granting full read/write within the database connection's privileges is genuinely severe. However, the same vector carries AC:H and AT:P, which materially qualify exploitability: this is a library-level flaw that is only reachable when the host application passes an attacker-controlled value as a collation into StringExpression or IdentifierExpression - collation values are seldom wired to untrusted input in typical CakePHP apps. No CISA KEV listing is present and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; a public research write-up (AbraxasLabs) and a VulnCheck advisory describe the technique, but the input does not confirm working exploit code. CONFLICT TO NOTE: the PR:N in the vector means no authentication is required at the library boundary, yet real-world risk is gated by the AT:P precondition (the application must expose collation to attacker input), so the raw 9.2 overstates exposure for deployments that never pass untrusted collation values. Treat as a high priority to patch because a fix exists and the impact is full database compromise, but prioritize instances where application code demonstrably feeds user input into collation.

A CakePHP application builds a query using StringExpression or IdentifierExpression and sets the COLLATE value from user-supplied input (e.g. a sort/locale parameter). An attacker submits a crafted collation string that, because the COLLATE clause is emitted unquoted, closes the clause and appends attacker-chosen SQL, which executes against any supported database driver with the connection's privileges. A public PoC reference exists (AbraxasLabs research); it is not verified as working exploit code.