CRITICAL
GHSA-vjqc-q4mp-2rvf
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Quick fix
GHSA-vjqc-q4mp-2rvf — cakephp/database: upgrade to the fixed version with the command below.
composer require cakephp/database:^4.5.12Details
### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
### Workarounds Don't provide user controlled data to these functions/parameters.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/cakephp/database
Introduced in:
0Fixed in: 4.5.12Fix
composer require cakephp/database:^4.5.12Packagist/cakephp/database
Introduced in:
4.6.0Fixed in: 4.6.5Fix
composer require cakephp/database:^4.6.5Packagist/cakephp/database
Introduced in:
5.0.0Fixed in: 5.1.9Fix
composer require cakephp/database:^5.1.9Packagist/cakephp/database
Introduced in:
5.2.0Fixed in: 5.2.14Fix
composer require cakephp/database:^5.2.14Packagist/cakephp/database
Introduced in:
5.3.0Fixed in: 5.3.7Fix
composer require cakephp/database:^5.3.7Packagist/cakephp/cakephp
Introduced in:
0Fixed in: 4.5.12Fix
composer require cakephp/cakephp:^4.5.12Packagist/cakephp/cakephp
Introduced in:
4.6.0Fixed in: 4.6.5Fix
composer require cakephp/cakephp:^4.6.5Packagist/cakephp/cakephp
Introduced in:
5.0.0Fixed in: 5.1.9Fix
composer require cakephp/cakephp:^5.1.9Packagist/cakephp/cakephp
Introduced in:
5.2.0Fixed in: 5.2.14Fix
composer require cakephp/cakephp:^5.2.14Packagist/cakephp/cakephp
Introduced in:
5.3.0Fixed in: 5.3.7Fix
composer require cakephp/cakephp:^5.3.7References
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752[ADVISORY]
- https://github.com/cakephp/cakephp/pull/19520[WEB]
- https://github.com/cakephp/cakephp/pull/19528[WEB]
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0[WEB]
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e[WEB]
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676[WEB]
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d[WEB]
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45[WEB]
- https://github.com/cakephp/cakephp[PACKAGE]
- https://github.com/cakephp/cakephp/releases/tag/4.5.12[WEB]
- https://github.com/cakephp/cakephp/releases/tag/4.6.5[WEB]
- https://github.com/cakephp/cakephp/releases/tag/5.1.8[WEB]
- https://github.com/cakephp/cakephp/releases/tag/5.1.9[WEB]
- https://github.com/cakephp/cakephp/releases/tag/5.2.14[WEB]
- https://github.com/cakephp/cakephp/releases/tag/5.3.7[WEB]