CakePHP: View::element() is missing a path containment check

TRUNG BÌNH 6.3CVE-2026-48820 · GHSA-wpvj-hjcr-h3p2 · Công bố 17/06/2026 · cập nhật 23/06/2026

Tóm tắt nhanh

CVE-2026-48820 là lỗ hổng mức TRUNG BÌNH (CVSS 6.3) ảnh hưởng cakephp/cakephp.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.26%, cao hơn 17.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.6.4, 5.1.7, 5.2.13, 5.3.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
cakephp/cakephp Packagist	`≥ 4.6.0, < 4.6.4≥ 5.0.0, < 5.1.7≥ 5.2.0, < 5.2.13≥ 5.3.0, < 5.3.6< 4.5.11`	`4.6.45.1.75.2.135.3.64.5.11`

Mô tả

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

Mô tả của NVD

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.