En bref
- CVE-2026-48820 est une vulnérabilité MOYENNE (CVSS 6.3) touchant cakephp/cakephp.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 17.5% des vulnérabilités.
- Correctif : mettre à jour vers 4.6.4, 5.1.7, 5.2.13, 5.3.6 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 4.6.0, < 4.6.4≥ 5.0.0, < 5.1.7≥ 5.2.0, < 5.2.13≥ 5.3.0, < 5.3.6< 4.5.11
| 4.6.45.1.75.2.135.3.64.5.11
|
Description
Impact
View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.
Patches
Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Workarounds
If developers are not using user-supplied data in element names, no action is required.
NVD description
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free