What is the CVSS score of CVE-2026-23643?

CVE-2026-23643 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cakephp are affected by CVE-2026-23643?

Organizations using CakePHP should be aware of moderate risk from CVE-2026-23643, a cross-site scripting vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2026-23643?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Cakephp CVE-2026-23643

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-01-16 security-advisories@github.com

GHSA-qh8m-9qxx-53m5

Red Hat Cakephp

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 23, 2026 - 20:51 nvd

Patch available

CVE Published

Jan 16, 2026 - 21:15 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

AnalysisAI

CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::limitControl() method that allows unauthenticated attackers to inject malicious scripts through query string parameters. An attacker can exploit this to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. The vulnerability requires user interaction to trigger but affects all installations using the vulnerable PaginatorHelper component.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the query string component of Cakephp. CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 5.2.12. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.