~ / search / GHSA-vjqc-q4mp-2rvf

GHSA-vjqc-q4mp-2rvf

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-79752

Packages

EcosystemPackageAffectedFixed in
Packagist cakephp/database >= 3.0.0, < 4.5.12 4.5.12
Packagist cakephp/database >= 4.6.0, < 4.6.5 4.6.5
Packagist cakephp/database >= 5.0.0, < 5.1.9 5.1.9
Packagist cakephp/database >= 5.2.0, < 5.2.14 5.2.14
Packagist cakephp/database >= 5.3.0, < 5.3.7 5.3.7
Packagist cakephp/cakephp < 4.5.12 4.5.12
Packagist cakephp/cakephp >= 4.6.0, < 4.6.5 4.6.5
Packagist cakephp/cakephp >= 5.0.0, < 5.1.9 5.1.9
Packagist cakephp/cakephp >= 5.2.0, < 5.2.14 5.2.14
Packagist cakephp/cakephp >= 5.3.0, < 5.3.7 5.3.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters.

References

External links from the advisory. They lead to third-party sites.