CakePHP: View::element() is missing a path containment check

MITTEL 6.3CVE-2026-48820 · GHSA-wpvj-hjcr-h3p2 · Published 17/06/2026 · updated 23/06/2026

Kurz gesagt

CVE-2026-48820 ist eine Schwachstelle (MITTEL (CVSS 6.3)) in cakephp/cakephp.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.26%, höher als bei 17.5% aller Schwachstellen.
Abhilfe: auf 4.6.4, 5.1.7, 5.2.13, 5.3.6 oder neuer aktualisieren.

Package	Affected versions	Patched versions
cakephp/cakephp Packagist	`≥ 4.6.0, < 4.6.4≥ 5.0.0, < 5.1.7≥ 5.2.0, < 5.2.13≥ 5.3.0, < 5.3.6< 4.5.11`	`4.6.45.1.75.2.135.3.64.5.11`

Description

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

NVD description

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.