CVE-2026-79752criticalCWE-89

CVE-2026-79752: critical vulnerability in cakephp

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Published

Follow this CVE+ Monitor cakephp+ Monitor cakephp/cakephp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.2epss 0.6%
from disclosure to weapon2 days
Published on NVDSep 17
1st PoC+2d
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
cakephp · cakephp
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cakephp

In the same product, most dangerous first.

CVE-2023-22727CRITICALDatabase Query::offset() and limit() vulnerable to SQL injection in cakephpEPSS 0.9%CVE-2026-77635CRITICALCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverEPSS 0.5%CVE-2026-119418CRITICALCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()EPSS 0.5%CVE-2026-119417MEDIUMCakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportEPSS 0.5%CVE-2026-119419CRITICALCakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression CollationEPSS 0.4%CVE-2026-119415MEDIUMCakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-TypeEPSS 0.4%