EUVD-2026-65121Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SQLi with no auth or interaction (PR:N/UI:N), but AC:H reflects the required Postgres driver plus application passing user data into jsonPath; SQLi yields high confidentiality/integrity and low availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
AnalysisAI
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete conditions are required: (1) the application must use CakePHP's PostgresDriver (PostgreSQL backend) - this is the AT:P attack requirement, and MySQL/SQLite/SQL Server deployments are not affected; and (2) application code must pass user-controlled input into the jsonPath (second) argument of FunctionsBuilder::jsonValue(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L): network-reachable, low-complexity, unauthenticated, with high confidentiality and integrity impact and low availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A CakePHP application running on PostgreSQL exposes a search or filtering feature that forwards a user-supplied JSON path into $query->func()->jsonValue('column', $userInput). The attacker submits a crafted jsonPath such as "x')) > '0' OR (SELECT 1) --", breaking out of the intended jsonpath expression to inject arbitrary SQL and read or alter database contents. … |
| Remediation | Vendor-released patch: upgrade to CakePHP 5.1.10, 5.2.15, or 5.3.7 according to your release line (release tags https://github.com/cakephp/cakephp/releases/tag/5.1.10, /5.2.15, /5.3.7; fix commit 138f2f61486532c29ee4d106da2a9848c1ff1ab3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using CakePHP 5.1.x, 5.2.x, or 5.3.x with PostgreSQL databases and audit for use of FunctionsBuilder::jsonValue(). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via X
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP head
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method pa
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMT
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotel
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files fro
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::l
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today