Critical severityNVD Advisory· Published Sep 17, 2026· Updated Sep 30, 2026
CVE-2026-79752
CVE-2026-79752
Description
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
cakephp/databasePackagist | >= 3.0.0, < 4.5.12 | 4.5.12 |
cakephp/databasePackagist | >= 4.6.0, < 4.6.5 | 4.6.5 |
cakephp/databasePackagist | >= 5.0.0, < 5.1.9 | 5.1.9 |
cakephp/databasePackagist | >= 5.2.0, < 5.2.14 | 5.2.14 |
cakephp/databasePackagist | >= 5.3.0, < 5.3.7 | 5.3.7 |
cakephp/cakephpPackagist | < 4.5.12 | 4.5.12 |
cakephp/cakephpPackagist | >= 4.6.0, < 4.6.5 | 4.6.5 |
cakephp/cakephpPackagist | >= 5.0.0, < 5.1.9 | 5.1.9 |
cakephp/cakephpPackagist | >= 5.2.0, < 5.2.14 | 5.2.14 |
cakephp/cakephpPackagist | >= 5.3.0, < 5.3.7 | 5.3.7 |
Affected products
1Patches
Vulnerability mechanics
References
17- github.com/advisories/GHSA-vjqc-q4mp-2rvfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-79752ghsaADVISORY
- github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0nvdWEB
- github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2envdWEB
- github.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71ghsaWEB
- github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676nvdWEB
- github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7dnvdWEB
- github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45nvdWEB
- github.com/cakephp/cakephp/pull/19520nvdWEB
- github.com/cakephp/cakephp/pull/19528nvdWEB
- github.com/cakephp/cakephp/releases/tag/4.5.12nvdWEB
- github.com/cakephp/cakephp/releases/tag/4.6.5nvdWEB
- github.com/cakephp/cakephp/releases/tag/5.1.8ghsaWEB
- github.com/cakephp/cakephp/releases/tag/5.1.9nvdWEB
- github.com/cakephp/cakephp/releases/tag/5.2.14nvdWEB
- github.com/cakephp/cakephp/releases/tag/5.3.7nvdWEB
- github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvfnvdWEB
News mentions
0No linked articles in our index yet.