Kurz gesagt
- CVE-2026-77635 ist eine Schwachstelle (KRITISCH (CVSS 9.2)) in cakephp/cakephp, cakephp/database.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.49%, höher als bei 42.3% aller Schwachstellen.
- Abhilfe: auf 5.1.10, 5.2.15, 5.3.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
| cakephp/database Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
Description
Impact
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches
5.1.10, 5.2.15, 5.3.7
Workarounds
Don't provide user controlled data to these functions/parameters.
NVD description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free