CakePHP vulnerable to Remote File Inclusion through View template name manipulation

概要

参考情報

• cakephp/cakephp commit 5e60cc5 · WEB
• bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html · WEB
• FriendsOfPHP/security-advisories · WEB
• cakephp/cakephp · PACKAGE

cakephp/cakephp のその他の脆弱性

• CVE-2026-119417低 3.7CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnera…
• CVE-2026-79752緊急 9.2CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder…
• CVE-2026-77635緊急 9.2CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBu…
• CVE-2026-48820中 6.3CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.…
• CVE-2026-23643中 5.4CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via qu…