Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

CakePHP can let attackers inject malicious database queries

CVE-2026-79752 · published 24 days ago
Summary

Versions of CakePHP before the latest releases allow certain functions to insert user‑provided values directly into SQL statements. This can let an attacker change, view, or delete data depending on the database permissions. Update to the newest CakePHP version to close the gap.

What to do
  • Update cakephp database to version 4.5.12.
  • Update cakephp database to version 4.6.5.
  • Update cakephp database to version 5.1.9.
  • Update cakephp database to version 5.2.14.
  • Update cakephp database to version 5.3.7.
  • Update cakephp cakephp to version 4.5.12.
  • Update cakephp cakephp to version 4.6.5.
  • Update cakephp cakephp to version 5.1.9.
  • Update cakephp cakephp to version 5.2.14.
  • Update cakephp cakephp to version 5.3.7.
  • Update cakephp cakephp/database to version 4.5.12.
  • Update cakephp cakephp/database to version 4.6.5.
  • Update cakephp cakephp/database to version 5.1.9.
  • Update cakephp cakephp/database to version 5.2.14.
  • Update cakephp cakephp/database to version 5.3.7.
  • Update cakephp cakephp/cakephp to version 4.5.12.
  • Update cakephp cakephp/cakephp to version 4.6.5.
  • Update cakephp cakephp/cakephp to version 5.1.9.
  • Update cakephp cakephp/cakephp to version 5.2.14.
  • Update cakephp cakephp/cakephp to version 5.3.7.
Affected software
Ecosystem VendorProductAffected versions
– cakephp cakephp < 4.5.12
composer cakephp database < 4.5.12
>= 4.6.0, < 4.6.5
>= 5.0.0, < 5.1.9
>= 5.2.0, < 5.2.14
>= 5.3.0, < 5.3.7
>= 3.0.0, < 4.5.12
Fix: upgrade to 4.5.12
composer cakephp cakephp < 4.5.12
>= 4.6.0, < 4.6.5
>= 5.0.0, < 5.1.9
>= 5.2.0, < 5.2.14
>= 5.3.0, < 5.3.7
Fix: upgrade to 4.5.12
Packagist cakephp cakephp/database < 4.5.12
>= 4.6.0, < 4.6.5
>= 5.0.0, < 5.1.9
>= 5.2.0, < 5.2.14
>= 5.3.0, < 5.3.7
>= 3.0.0, < 4.5.12
Fix: upgrade to 4.5.12
Packagist cakephp cakephp/cakephp < 4.5.12
>= 4.6.0, < 4.6.5
>= 5.0.0, < 5.1.9
>= 5.2.0, < 5.2.14
>= 5.3.0, < 5.3.7
Fix: upgrade to 4.5.12
Original advisory text
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-79752 · NVD
CVE-2026-79752 · MITRE
GHSA-vjqc-q4mp-2rvf · GHSA
CVE-2026-79752 · OSV
GHSA-vjqc-q4mp-2rvf · OSV
Track software like this
Free during beta