~ / search / GHSA-fxf7-vhh8-7vpq

GHSA-fxf7-vhh8-7vpq

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-77635

Packages

EcosystemPackageAffectedFixed in
Packagist cakephp/cakephp >= 5.3.0, < 5.3.7 5.3.7
Packagist cakephp/cakephp >= 5.2.0, < 5.2.15 5.2.15
Packagist cakephp/cakephp >= 5.1.0, < 5.1.10 5.1.10
Packagist cakephp/database >= 5.3.0, < 5.3.7 5.3.7
Packagist cakephp/database >= 5.2.0, < 5.2.15 5.2.15
Packagist cakephp/database >= 5.1.0, < 5.1.10 5.1.10

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. ### Patches 5.1.10, 5.2.15, 5.3.7 ### Workarounds Don't provide user controlled data to these functions/parameters.

References

External links from the advisory. They lead to third-party sites.