Kurz gesagt
- CVE-2026-23643 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in cakephp/cakephp, cakephp (cakephp).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.28%, höher als bei 20.7% aller Schwachstellen.
- Abhilfe: auf 5.2.12, 5.3.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 5.2.10, < 5.2.12≥ 5.3.0, < 5.3.1
| 5.2.125.3.1
|
| cakephp | = 5.3.0≥ 5.2.10, < 5.2.12
| 5.2.12
|
Description
Impact
The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches
This issue has been fixed in 5.2.12 and 5.3.1
Workarounds
If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
NVD description
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free