VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 16, 2026· Updated Jan 16, 2026

CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

CVE-2026-23643

Description

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cakephp/cakephpPackagist
>= 5.2.10, < 5.2.125.2.12
cakephp/cakephpPackagist
>= 5.3.0, < 5.3.15.3.1

Affected products

1

Patches

1
c842e7f45d85

Fix missing HTML escaping in PaginatorHelper

https://github.com/cakephp/cakephpMark StoryJan 14, 2026via ghsa
commit
2 files changed · +41 −1
  • src/View/Helper/PaginatorHelper.php+1 −1 modified
    @@ -1311,7 +1311,7 @@ protected function generateHiddenFields(array $data, string $prefix = ''): strin
                 $out .= $this->generateHiddenFields($value, $fieldName);
             } else {
                 // Generate hidden field for scalar values
-                $out .= $this->Form->hidden($fieldName, ['value' => $value]);
+                $out .= $this->Form->hidden(h($fieldName), ['value' => $value]);
             }
         }
  • tests/TestCase/View/Helper/PaginatorHelperTest.php+40 −0 modified
    @@ -3115,6 +3115,46 @@ public function testLimitControlUrlWithQuery(): void
         $this->assertHtml($expected, $out);
     }
 
+    /**
+     * test the limitControl() escapes query parameters
+     *
+     * @return void
+     */
+    public function testLimitControlUrlWithQueryEscaping(): void
+    {
+        $request = new ServerRequest([
+            'url' => '/batches?page=2&xyz"/><script>alert(\'hi\')</script>xyz=hi',
+            'params' => [
+                'plugin' => null, 'controller' => 'Batches', 'action' => 'index', 'pass' => [],
+            ],
+            'query' => ['xyz"/><script>alert(\'hi\')</script>xyz' => 'hi'],
+            'base' => '',
+            'webroot' => '/',
+        ]);
+        Router::setRequest($request);
+        $this->View->setRequest($request);
+        $this->setPaginatedResult(['perPage' => 10, 'currentPage' => 2]);
+
+        $out = $this->Paginator->limitControl([1 => 1]);
+        $expected = [
+            ['form' => ['method' => 'get', 'accept-charset' => 'utf-8', 'action' => '/Batches/index']],
+            ['input' => ['type' => 'hidden', 'name' => 'xyz&quot;/&gt;&lt;script&gt;alert(&#039;hi&#039;)&lt;/script&gt;xyz', 'value' => 'hi']],
+            ['input' => ['type' => 'hidden', 'name' => 'page', 'value' => '1']],
+            ['div' => ['class' => 'input select']],
+            ['label' => ['for' => 'limit']],
+            'View',
+            '/label',
+            ['select' => ['name' => 'limit', 'id' => 'limit', 'onChange' => 'this.form.requestSubmit()']],
+            ['option' => ['value' => '1']],
+            '1',
+            '/option',
+            '/select',
+            '/div',
+            '/form',
+        ];
+        $this->assertHtml($expected, $out);
+    }
+
     /**
      * test the limitControl() method with defaults and query
      */

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.