CVE-2026-79752

Description

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

References

https://github.com/abraxas/CVE-2026-79752

https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf

https://github.com/cakephp/cakephp/releases/tag/5.3.7

https://github.com/cakephp/cakephp/releases/tag/5.2.14

https://github.com/cakephp/cakephp/releases/tag/5.1.9

https://github.com/cakephp/cakephp/releases/tag/4.6.5

https://github.com/cakephp/cakephp/releases/tag/4.5.12

https://github.com/cakephp/cakephp/pull/19528

https://github.com/cakephp/cakephp/pull/19520

https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45

https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d

https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676

https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e

https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS