In breve
- CVE-2026-77635 è una vulnerabilità CRITICO (CVSS 9.2) che riguarda cakephp/cakephp, cakephp/database.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 42.4% delle vulnerabilità.
- Correzione: aggiornare a 5.1.10, 5.2.15, 5.3.7 o successiva.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
| cakephp/database Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
Description
Impact
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches
5.1.10, 5.2.15, 5.3.7
Workarounds
Don't provide user controlled data to these functions/parameters.
NVD description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free