Cakephp
Monthly
SQL injection in CakePHP 5.4.3 and earlier allows an attacker who can influence a collation name passed to the StringExpression or IdentifierExpression constructor (or setCollation()) to append arbitrary SQL after the unquoted COLLATE clause, with the injected statement executing under the privileges of the application's database connection on every bundled driver. Exploitation is gated by a real precondition: application code must specifically route attacker-controlled data into a collation argument, which is why the assessed vector carries high attack complexity despite requiring no authentication (PR:N) and no user interaction. Vendor fix commits and PR 19726 are available, no exact patched release number is stated in the advisory, and no public exploit was identified at time of analysis.
SQL injection in CakePHP through 5.4.3 allows an attacker who can influence window-function query parameters to inject SQL that executes with the database connection's privileges, giving full confidentiality, integrity and availability impact and a CVSS 4.0 base score of 9.2. The exposure is conditional: only applications that forward unvalidated user input into a window OVER clause - the frame offsets and directions of WindowExpression::range() and frame(), or the related partition, orderBy and function-name strings - are reachable, so a stock CakePHP deployment without that coding pattern is not exploitable. Attacker authentication at the framework level is not required and no user interaction is needed, vendor fix commits and PR 19735 are available, no confirmed public exploit code is identified in the reporting, and the priority guidance is act_now.
SQL injection in the CakePHP PHP framework (versions prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7) allows unauthenticated remote attackers to inject arbitrary SQL when an application forwards untrusted input into the $dataType, $part, or $unit arguments of FunctionsBuilder::cast, ::extract, ::datePart, and ::dateAdd, which the framework incorporates into generated SQL as unescaped structural fragments rather than bound parameters. Successful exploitation yields high confidentiality, integrity, and availability impact bounded by the privileges of the application's database connection, as reflected in the vendor's CVSS 4.0 score of 9.2 (CWE-89); however, the attack requires the non-default precondition that the application itself passes attacker-controllable data to these trusted-structure parameters, which is not an idiomatic usage pattern. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, though the framework's broad deployment makes prompt patching advisable.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). An attacker who can influence those header values can inject arbitrary SMTP headers (e.g., Bcc, Reply-To, Content-Type), potentially hijacking email routing or silently copying messages; no public exploit identified at time of analysis.
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.
Email header injection in CakePHP's SmtpTransport and MailTransport lets data that an application places into custom mail headers via Message::setHeaders() or Message::addHeaders() break out of the header line and add or alter headers such as Bcc, redirecting or modifying outgoing mail. Affected releases named in the CVE are 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3; the flaw is an incomplete fix for CVE-2026-77634, which stripped only full CRLF pairs and left bare CR or LF bytes intact. Impact is confined to message integrity (no confidentiality or availability effect) and only materializes when an application itself feeds untrusted input into custom headers; no authentication or user interaction is required of the attacker, and no public exploit code was identified at time of analysis. This is a medium-severity, defensive-priority issue rather than an emergency.
Cookie domain handling in CakePHP's Http Client CookieCollection, affecting releases through 5.4.3, relies on unanchored suffix matching in both directions: outbound requests could carry cookies scoped to 'example.com' to a host such as 'notexample.com', and inbound Set-Cookie headers with a Domain belonging to an unrelated host were accepted into the jar. An attacker who controls a suffix-adjacent or otherwise unrelated server that a victim application contacts through Http\Client can therefore read leaked session cookies or plant cookies into a cookie jar shared across hosts. The flaw is client-side and exploitable only where an application uses Http\Client and reuses one CookieCollection across outbound requests; it is not in CISA KEV, and the supplied sources do not confirm working exploit code, while an upstream fix exists in commits referenced by PR 19702 and a vendor advisory is available.
CRLF injection in CakePHP's multipart/MIME handling (FormDataPart and Mailer attachment code) through 5.4.3 lets an attacker who can influence an attachment's declared MIME Content-Type or Content-ID break out of the intended header line and add arbitrary MIME part headers or content. The flaw is not exploitable in a default configuration: it only materializes when the consuming application passes unsanitized user input into Message::setAttachments()/addAttachment() or into FormDataPart type/contentId values for HTTP client multipart bodies, which is why the assessed vector carries AC:H and AT:P while remaining unauthenticated. Impact is integrity-only (no confidentiality or availability effect) and the concrete downstream outcome - email content spoofing, malformed MIME accepted by a downstream parser, or altered multipart requests - depends on the consumer; no confirmed working exploit code was identified at time of analysis, though a public research writeup of the CRLF issue exists and the vendor fix is published.
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files from the server filesystem when applications render view elements using user-controlled data. Affected versions span multiple major release lines across 4.x and 5.x branches, with patched releases now available from the vendor. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the developer-pattern dependency — user input passed unsanitized into element names — limits but does not eliminate real-world risk.
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::limitControl() method that allows unauthenticated attackers to inject malicious scripts through query string parameters. An attacker can exploit this to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. The vulnerability requires user interaction to trigger but affects all installations using the vulnerable PaginatorHelper component.
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.9%.
SQL injection in CakePHP 5.4.3 and earlier allows an attacker who can influence a collation name passed to the StringExpression or IdentifierExpression constructor (or setCollation()) to append arbitrary SQL after the unquoted COLLATE clause, with the injected statement executing under the privileges of the application's database connection on every bundled driver. Exploitation is gated by a real precondition: application code must specifically route attacker-controlled data into a collation argument, which is why the assessed vector carries high attack complexity despite requiring no authentication (PR:N) and no user interaction. Vendor fix commits and PR 19726 are available, no exact patched release number is stated in the advisory, and no public exploit was identified at time of analysis.
SQL injection in CakePHP through 5.4.3 allows an attacker who can influence window-function query parameters to inject SQL that executes with the database connection's privileges, giving full confidentiality, integrity and availability impact and a CVSS 4.0 base score of 9.2. The exposure is conditional: only applications that forward unvalidated user input into a window OVER clause - the frame offsets and directions of WindowExpression::range() and frame(), or the related partition, orderBy and function-name strings - are reachable, so a stock CakePHP deployment without that coding pattern is not exploitable. Attacker authentication at the framework level is not required and no user interaction is needed, vendor fix commits and PR 19735 are available, no confirmed public exploit code is identified in the reporting, and the priority guidance is act_now.
SQL injection in the CakePHP PHP framework (versions prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7) allows unauthenticated remote attackers to inject arbitrary SQL when an application forwards untrusted input into the $dataType, $part, or $unit arguments of FunctionsBuilder::cast, ::extract, ::datePart, and ::dateAdd, which the framework incorporates into generated SQL as unescaped structural fragments rather than bound parameters. Successful exploitation yields high confidentiality, integrity, and availability impact bounded by the privileges of the application's database connection, as reflected in the vendor's CVSS 4.0 score of 9.2 (CWE-89); however, the attack requires the non-default precondition that the application itself passes attacker-controllable data to these trusted-structure parameters, which is not an idiomatic usage pattern. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, though the framework's broad deployment makes prompt patching advisable.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). An attacker who can influence those header values can inject arbitrary SMTP headers (e.g., Bcc, Reply-To, Content-Type), potentially hijacking email routing or silently copying messages; no public exploit identified at time of analysis.
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.
Email header injection in CakePHP's SmtpTransport and MailTransport lets data that an application places into custom mail headers via Message::setHeaders() or Message::addHeaders() break out of the header line and add or alter headers such as Bcc, redirecting or modifying outgoing mail. Affected releases named in the CVE are 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3; the flaw is an incomplete fix for CVE-2026-77634, which stripped only full CRLF pairs and left bare CR or LF bytes intact. Impact is confined to message integrity (no confidentiality or availability effect) and only materializes when an application itself feeds untrusted input into custom headers; no authentication or user interaction is required of the attacker, and no public exploit code was identified at time of analysis. This is a medium-severity, defensive-priority issue rather than an emergency.
Cookie domain handling in CakePHP's Http Client CookieCollection, affecting releases through 5.4.3, relies on unanchored suffix matching in both directions: outbound requests could carry cookies scoped to 'example.com' to a host such as 'notexample.com', and inbound Set-Cookie headers with a Domain belonging to an unrelated host were accepted into the jar. An attacker who controls a suffix-adjacent or otherwise unrelated server that a victim application contacts through Http\Client can therefore read leaked session cookies or plant cookies into a cookie jar shared across hosts. The flaw is client-side and exploitable only where an application uses Http\Client and reuses one CookieCollection across outbound requests; it is not in CISA KEV, and the supplied sources do not confirm working exploit code, while an upstream fix exists in commits referenced by PR 19702 and a vendor advisory is available.
CRLF injection in CakePHP's multipart/MIME handling (FormDataPart and Mailer attachment code) through 5.4.3 lets an attacker who can influence an attachment's declared MIME Content-Type or Content-ID break out of the intended header line and add arbitrary MIME part headers or content. The flaw is not exploitable in a default configuration: it only materializes when the consuming application passes unsanitized user input into Message::setAttachments()/addAttachment() or into FormDataPart type/contentId values for HTTP client multipart bodies, which is why the assessed vector carries AC:H and AT:P while remaining unauthenticated. Impact is integrity-only (no confidentiality or availability effect) and the concrete downstream outcome - email content spoofing, malformed MIME accepted by a downstream parser, or altered multipart requests - depends on the consumer; no confirmed working exploit code was identified at time of analysis, though a public research writeup of the CRLF issue exists and the vendor fix is published.
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files from the server filesystem when applications render view elements using user-controlled data. Affected versions span multiple major release lines across 4.x and 5.x branches, with patched releases now available from the vendor. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the developer-pattern dependency — user input passed unsanitized into element names — limits but does not eliminate real-world risk.
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::limitControl() method that allows unauthenticated attackers to inject malicious scripts through query string parameters. An attacker can exploit this to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. The vulnerability requires user interaction to trigger but affects all installations using the vulnerable PaginatorHelper component.
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.9%.