CakePHP EUVD-2026-65121

Two concrete conditions are required: (1) the application must use CakePHP's PostgresDriver (PostgreSQL backend) - this is the AT:P attack requirement, and MySQL/SQLite/SQL Server deployments are not affected; and (2) application code must pass user-controlled input into the jsonPath (second) argument of FunctionsBuilder::jsonValue(). What limits exploitation: it is not triggerable against default CakePHP behavior - a developer must actively route untrusted data into jsonValue()'s jsonPath, and the app must run on Postgres. No authentication or user interaction is required by the framework flaw itself (PR:N/UI:N), so where the vulnerable pattern exists it is remotely and unauthenticated exploitable.

The CVSS 4.0 base score is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L): network-reachable, low-complexity, unauthenticated, with high confidentiality and integrity impact and low availability impact. The critical qualifier is AT:P (attack requirements present): exploitation depends on the application using the PostgreSQL driver AND passing untrusted input directly into jsonValue()'s jsonPath argument, which is an application coding pattern rather than default framework behavior. No EPSS score, KEV listing, or SSVC data were provided, so exploitation probability cannot be quantified from these signals; the vendor confirms the flaw and ships a patch. Net assessment: genuinely high severity where the vulnerable code path is used (SQLi enables data theft and manipulation), but the AT:P precondition narrows real-world exposure below what the raw 9.2 implies - many CakePHP apps use MySQL/other drivers or never route user input into jsonPath. Priority is high for Postgres-backed CakePHP apps using jsonValue() on user data, moderate otherwise.

A CakePHP application running on PostgreSQL exposes a search or filtering feature that forwards a user-supplied JSON path into $query->func()->jsonValue('column', $userInput). The attacker submits a crafted jsonPath such as "x')) > '0' OR (SELECT 1) --", breaking out of the intended jsonpath expression to inject arbitrary SQL and read or alter database contents. With a network vector, low complexity, and no authentication required by the flaw itself, exploitation is straightforward wherever this coding pattern exists.