Cakephp
CVE-2026-23643
MEDIUM
GHSA-qh8m-9qxx-53m5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
AnalysisAI
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::limitControl() method that allows unauthenticated attackers to inject malicious scripts through query string parameters. An attacker can exploit this to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. The vulnerability requires user interaction to trigger but affects all installations using the vulnerable PaginatorHelper component.
Technical ContextAI
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the query string component of Cakephp. CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 5.2.12. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via X
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP head
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method pa
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBui
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, a
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMT
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotel
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files fro
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today