GHSA-wpvj-hjcr-h3p2
CakePHP: View::element() is missing a path containment check
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | cakephp/cakephp | >= 5.3.0, < 5.3.6 | 5.3.6 |
| Packagist | cakephp/cakephp | >= 5.2.0, < 5.2.13 | 5.2.13 |
| Packagist | cakephp/cakephp | >= 5.0.0, < 5.1.7 | 5.1.7 |
| Packagist | cakephp/cakephp | >= 4.6.0, < 4.6.4 | 4.6.4 |
| Packagist | cakephp/cakephp | < 4.5.11 | 4.5.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
`View::_getElementFileName()` does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.
### Patches
Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
### Workarounds
If developers are not using user-supplied data in element names, no action is required.
References
External links from the advisory. They lead to third-party sites.