{"schema":"threatline.record/2","record":{"id":"CVE-2026-79752","aliases":["GHSA-vjqc-q4mp-2rvf"],"summary":"CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection","details":"### Impact\nThe `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.\n\n### Patches\n5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes \n\n### Workarounds\nDon't provide user controlled data to these functions/parameters.","categories":["Libraries & packages"],"product":"cakephp/database","vendor":"cakephp","ecosystem":"composer","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"range":">= 4.6.0, < 4.6.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"range":">= 5.0.0, < 5.1.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"range":">= 5.2.0, < 5.2.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"range":">= 5.3.0, < 5.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"range":"< 4.5.12"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"range":">= 4.6.0, < 4.6.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"range":">= 5.0.0, < 5.1.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"range":">= 5.2.0, < 5.2.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"range":">= 5.3.0, < 5.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"range":">= 3.0.0, < 4.5.12"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79752","source_modified_at":"2026-09-17T15:20:00.313Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"cakephp","vendor":"cakephp","versions":[{"version":"< 4.5.12","status":"affected"},{"version":">= 4.6.0, < 4.6.5","status":"affected"},{"version":">= 5.0.0, < 5.1.9","status":"affected"},{"version":">= 5.2.0, < 5.2.14","status":"affected"},{"version":">= 5.3.0, < 5.3.7","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"4.5.12"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.10","3.0.12","3.0.13","3.0.15","3.0.18","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC1","3.1.0-beta","3.1.0-beta2","3.1.1","3.1.10","3.1.13","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10.0","3.10.0-RC1","3.10.1","3.10.3","3.10.4","3.10.5","3.2.0","3.2.0-RC1","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.5"}],"type":"ECOSYSTEM"}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.1.9"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-RC1","5.1.0-RC2","5.1.1","5.1.2","5.1.4","5.1.5","5.1.6","5.1.8"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"ranges":[{"events":[{"introduced":"5.2.0"},{"fixed":"5.2.14"}],"type":"ECOSYSTEM"}],"versions":["5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.13","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"ranges":[{"events":[{"introduced":"5.3.0"},{"fixed":"5.3.7"}],"type":"ECOSYSTEM"}],"versions":["5.3.0","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.5.12"}],"type":"ECOSYSTEM"}],"versions":["2.10.0","2.10.0-RC1","2.10.1","2.10.10","2.10.11","2.10.12","2.10.13","2.10.14","2.10.15","2.10.16","2.10.17","2.10.18","2.10.19","2.10.2","2.10.20","2.10.21","2.10.22","2.10.23","2.10.24","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.10.8","2.10.9","2.4.10","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.0-RC1","2.5.0-RC2","2.5.0-beta","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.0-RC1","2.6.0-beta","2.6.1","2.6.10"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.5"}],"type":"ECOSYSTEM"}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3","4.6.4"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.1.9"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-RC1","5.1.0-RC2","5.1.1","5.1.2","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"ranges":[{"events":[{"introduced":"5.2.0"},{"fixed":"5.2.14"}],"type":"ECOSYSTEM"}],"versions":["5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.13","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"ranges":[{"events":[{"introduced":"5.3.0"},{"fixed":"5.3.7"}],"type":"ECOSYSTEM"}],"versions":["5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"version":"4.6.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"version":"5.1.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"version":"5.2.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"version":"5.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"version":"4.5.12"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"version":"4.6.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"version":"5.1.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"version":"5.2.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/cakephp"},"version":"5.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:36:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cakephp/database"},"version":"4.5.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"version":"4.5.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"version":"4.6.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"version":"5.1.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"version":"5.2.14"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/database","purl":"pkg:composer/cakephp/database"},"version":"5.3.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"version":"4.5.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"version":"4.6.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"version":"5.1.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"version":"5.2.14"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","source_modified_at":"2026-09-24T14:45:07.479142624Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"cakephp/cakephp","purl":"pkg:composer/cakephp/cakephp"},"version":"5.3.7"}],"cvss":9.2,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00621,"percentile":0.49117,"score_date":"2026-10-23"},"published_at":"2026-09-17T14:49:56.936Z","modified_at":"2026-09-24T14:45:07.479142624Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T14:36:11Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-79752","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-17T15:20:00.313Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T14:45:07.479142624Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79752","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79752","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/pull/19520","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/pull/19528","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/releases/tag/4.5.12","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/releases/tag/4.6.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/cakephp/cakephp/releases/tag/5.1.8","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/releases/tag/5.1.9","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/releases/tag/5.2.14","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cakephp/cakephp/releases/tag/5.3.7","tags":["x_refsource_MISC"]},{"url":"https://github.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-vjqc-q4mp-2rvf","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-17T15:19:49.116379Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-24T14:45:07.479142624Z","content_hash":"854797f31804e1b732aad2678eeec7a8c118c141e2be9eacb7365f55caecdd10"}}