Em resumo
- CVE-2026-77635 é uma vulnerabilidade CRÍTICO (CVSS 9.2) que afeta cakephp/cakephp, cakephp/database.
- Chance de exploração nos próximos 30 dias (EPSS): 0.49%, maior que 42.3% das vulnerabilidades.
- Correção: atualize para 5.1.10, 5.2.15, 5.3.7 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| cakephp/cakephp Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
| cakephp/database Packagist | ≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.1.105.2.155.3.7
|
Description
Impact
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches
5.1.10, 5.2.15, 5.3.7
Workarounds
Don't provide user controlled data to these functions/parameters.
NVD description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Mais vulnerabilidades de cakephp/cakephp
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free