CVE-2026-79752GHSA-vjqc-q4mp-2rvf
cakephp/database: CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
cakephp cakephp/databasecomposerLibraries & packages
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.62%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.6.5cakephp/database, composerGitHub
composer require "cakephp/database:^4.6.5" - 5.1.9cakephp/database, composerGitHub
composer require "cakephp/database:^5.1.9" - 5.2.14cakephp/database, composerGitHub
composer require "cakephp/database:^5.2.14" - 5.3.7cakephp/database, composerGitHub
composer require "cakephp/database:^5.3.7" - 4.5.12cakephp/cakephp, composerGitHub
composer require "cakephp/cakephp:^4.5.12" - 4.6.5cakephp/cakephp, composerGitHub
composer require "cakephp/cakephp:^4.6.5"
Show all 20 fixed versions
- 5.1.9cakephp/cakephp, composerGitHub
composer require "cakephp/cakephp:^5.1.9" - 5.2.14cakephp/cakephp, composerGitHub
composer require "cakephp/cakephp:^5.2.14" - 5.3.7cakephp/cakephp, composerGitHub
composer require "cakephp/cakephp:^5.3.7" - 4.5.12cakephp/database, composerGitHub
composer require "cakephp/database:^4.5.12" - 4.5.12cakephp/database, PackagistOSV
composer require "cakephp/database:^4.5.12" - 4.6.5cakephp/database, PackagistOSV
composer require "cakephp/database:^4.6.5" - 5.1.9cakephp/database, PackagistOSV
composer require "cakephp/database:^5.1.9" - 5.2.14cakephp/database, PackagistOSV
composer require "cakephp/database:^5.2.14" - 5.3.7cakephp/database, PackagistOSV
composer require "cakephp/database:^5.3.7" - 4.5.12cakephp/cakephp, PackagistOSV
composer require "cakephp/cakephp:^4.5.12" - 4.6.5cakephp/cakephp, PackagistOSV
composer require "cakephp/cakephp:^4.6.5" - 5.1.9cakephp/cakephp, PackagistOSV
composer require "cakephp/cakephp:^5.1.9" - 5.2.14cakephp/cakephp, PackagistOSV
composer require "cakephp/cakephp:^5.2.14" - 5.3.7cakephp/cakephp, PackagistOSV
composer require "cakephp/cakephp:^5.3.7"
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Impact
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds
Don't provide user controlled data to these functions/parameters.
Text from GitHub Advisory Database
Affected versions 217
- cakephp/database, composer>= 4.6.0, < 4.6.5GitHub
- cakephp/database, composer>= 5.0.0, < 5.1.9GitHub
- cakephp/database, composer>= 5.2.0, < 5.2.14GitHub
- cakephp/database, composer>= 5.3.0, < 5.3.7GitHub
- cakephp/cakephp, composer< 4.5.12GitHub
- cakephp/cakephp, composer>= 4.6.0, < 4.6.5GitHub
- cakephp/cakephp, composer>= 5.0.0, < 5.1.9GitHub
- cakephp/cakephp, composer>= 5.2.0, < 5.2.14GitHub
- cakephp/cakephp, composer>= 5.3.0, < 5.3.7GitHub
- cakephp/database, composer>= 3.0.0, < 4.5.12GitHub
- cakephpaffected: < 4.5.12CVE List
- cakephpaffected: >= 4.6.0, < 4.6.5CVE List
- cakephpaffected: >= 5.0.0, < 5.1.9CVE List
- cakephpaffected: >= 5.2.0, < 5.2.14CVE List
- cakephpaffected: >= 5.3.0, < 5.3.7CVE List
- cakephp/database, Packagistfrom 3.0.0, fixed in 4.5.12OSV
- cakephp/database, Packagist3.0.0OSV
- cakephp/database, Packagist3.0.1OSV
- cakephp/database, Packagist3.0.10OSV
- cakephp/database, Packagist3.0.12OSV
- cakephp/database, Packagist3.0.13OSV
- cakephp/database, Packagist3.0.15OSV
- cakephp/database, Packagist3.0.18OSV
- cakephp/database, Packagist3.0.2OSV
- cakephp/database, Packagist3.0.3OSV
- cakephp/database, Packagist3.0.4OSV
- cakephp/database, Packagist3.0.5OSV
- cakephp/database, Packagist3.0.6OSV
- cakephp/database, Packagist3.0.7OSV
- cakephp/database, Packagist3.0.8OSV
- cakephp/database, Packagist3.0.9OSV
- cakephp/database, Packagist3.1.0OSV
- cakephp/database, Packagist3.1.0-RC1OSV
- cakephp/database, Packagist3.1.0-betaOSV
- cakephp/database, Packagist3.1.0-beta2OSV
- cakephp/database, Packagist3.1.1OSV
- cakephp/database, Packagist3.1.10OSV
- cakephp/database, Packagist3.1.13OSV
- cakephp/database, Packagist3.1.2OSV
- cakephp/database, Packagist3.1.3OSV
- cakephp/database, Packagist3.1.4OSV
- cakephp/database, Packagist3.1.5OSV
- cakephp/database, Packagist3.1.6OSV
- cakephp/database, Packagist3.1.7OSV
- cakephp/database, Packagist3.1.8OSV
- cakephp/database, Packagist3.1.9OSV
- cakephp/database, Packagist3.10.0OSV
- cakephp/database, Packagist3.10.0-RC1OSV
- cakephp/database, Packagist3.10.1OSV
- cakephp/database, Packagist3.10.3OSV
- cakephp/database, Packagist3.10.4OSV
- cakephp/database, Packagist3.10.5OSV
- cakephp/database, Packagist3.2.0OSV
- cakephp/database, Packagist3.2.0-RC1OSV
- cakephp/database, Packagist3.2.1OSV
- cakephp/database, Packagist3.2.10OSV
- cakephp/database, Packagist3.2.11OSV
- cakephp/database, Packagist3.2.12OSV
- cakephp/database, Packagist3.2.13OSV
- cakephp/database, Packagist3.2.14OSV
- cakephp/database, Packagist3.2.2OSV
- cakephp/database, Packagist3.2.3OSV
- cakephp/database, Packagist3.2.4OSV
- cakephp/database, Packagist3.2.5OSV
- cakephp/database, Packagist3.2.6OSV
- cakephp/database, Packagist3.2.7OSV
- cakephp/database, Packagistfrom 4.6.0, fixed in 4.6.5OSV
- cakephp/database, Packagist4.6.0OSV
- cakephp/database, Packagist4.6.1OSV
- cakephp/database, Packagist4.6.2OSV
- cakephp/database, Packagist4.6.3OSV
- cakephp/database, Packagistfrom 5.0.0, fixed in 5.1.9OSV
- cakephp/database, Packagist5.0.0OSV
- cakephp/database, Packagist5.0.10OSV
- cakephp/database, Packagist5.0.11OSV
- cakephp/database, Packagist5.0.2OSV
- cakephp/database, Packagist5.0.3OSV
- cakephp/database, Packagist5.0.4OSV
- cakephp/database, Packagist5.0.5OSV
- cakephp/database, Packagist5.0.6OSV
- cakephp/database, Packagist5.0.7OSV
- cakephp/database, Packagist5.0.8OSV
- cakephp/database, Packagist5.0.9OSV
- cakephp/database, Packagist5.1.0OSV
- cakephp/database, Packagist5.1.0-RC1OSV
- cakephp/database, Packagist5.1.0-RC2OSV
- cakephp/database, Packagist5.1.1OSV
- cakephp/database, Packagist5.1.2OSV
- cakephp/database, Packagist5.1.4OSV
- cakephp/database, Packagist5.1.5OSV
- cakephp/database, Packagist5.1.6OSV
- cakephp/database, Packagist5.1.8OSV
- cakephp/database, Packagistfrom 5.2.0, fixed in 5.2.14OSV
- cakephp/database, Packagist5.2.0OSV
- cakephp/database, Packagist5.2.1OSV
- cakephp/database, Packagist5.2.10OSV
- cakephp/database, Packagist5.2.11OSV
- cakephp/database, Packagist5.2.12OSV
- cakephp/database, Packagist5.2.13OSV
- cakephp/database, Packagist5.2.2OSV
- cakephp/database, Packagist5.2.3OSV
- cakephp/database, Packagist5.2.4OSV
- cakephp/database, Packagist5.2.5OSV
- cakephp/database, Packagist5.2.6OSV
- cakephp/database, Packagist5.2.7OSV
- cakephp/database, Packagist5.2.8OSV
- cakephp/database, Packagist5.2.9OSV
- cakephp/database, Packagistfrom 5.3.0, fixed in 5.3.7OSV
- cakephp/database, Packagist5.3.0OSV
- cakephp/database, Packagist5.3.2OSV
- cakephp/database, Packagist5.3.3OSV
- cakephp/database, Packagist5.3.4OSV
- cakephp/database, Packagist5.3.5OSV
- cakephp/database, Packagist5.3.6OSV
- cakephp/cakephp, Packagistfrom first release, fixed in 4.5.12OSV
- cakephp/cakephp, Packagist2.10.0OSV
- cakephp/cakephp, Packagist2.10.0-RC1OSV
- cakephp/cakephp, Packagist2.10.1OSV
- cakephp/cakephp, Packagist2.10.10OSV
- cakephp/cakephp, Packagist2.10.11OSV
- cakephp/cakephp, Packagist2.10.12OSV
- cakephp/cakephp, Packagist2.10.13OSV
- cakephp/cakephp, Packagist2.10.14OSV
- cakephp/cakephp, Packagist2.10.15OSV
- cakephp/cakephp, Packagist2.10.16OSV
- cakephp/cakephp, Packagist2.10.17OSV
- cakephp/cakephp, Packagist2.10.18OSV
- cakephp/cakephp, Packagist2.10.19OSV
- cakephp/cakephp, Packagist2.10.2OSV
- cakephp/cakephp, Packagist2.10.20OSV
- cakephp/cakephp, Packagist2.10.21OSV
- cakephp/cakephp, Packagist2.10.22OSV
- cakephp/cakephp, Packagist2.10.23OSV
- cakephp/cakephp, Packagist2.10.24OSV
- cakephp/cakephp, Packagist2.10.3OSV
- cakephp/cakephp, Packagist2.10.4OSV
- cakephp/cakephp, Packagist2.10.5OSV
- cakephp/cakephp, Packagist2.10.6OSV
- cakephp/cakephp, Packagist2.10.7OSV
- cakephp/cakephp, Packagist2.10.8OSV
- cakephp/cakephp, Packagist2.10.9OSV
- cakephp/cakephp, Packagist2.4.10OSV
- cakephp/cakephp, Packagist2.4.5OSV
- cakephp/cakephp, Packagist2.4.6OSV
- cakephp/cakephp, Packagist2.4.7OSV
- cakephp/cakephp, Packagist2.4.8OSV
- cakephp/cakephp, Packagist2.4.9OSV
- cakephp/cakephp, Packagist2.5.0OSV
- cakephp/cakephp, Packagist2.5.0-RC1OSV
- cakephp/cakephp, Packagist2.5.0-RC2OSV
- cakephp/cakephp, Packagist2.5.0-betaOSV
- cakephp/cakephp, Packagist2.5.1OSV
- cakephp/cakephp, Packagist2.5.2OSV
- cakephp/cakephp, Packagist2.5.3OSV
- cakephp/cakephp, Packagist2.5.4OSV
- cakephp/cakephp, Packagist2.5.5OSV
- cakephp/cakephp, Packagist2.5.6OSV
- cakephp/cakephp, Packagist2.5.7OSV
- cakephp/cakephp, Packagist2.5.8OSV
- cakephp/cakephp, Packagist2.5.9OSV
- cakephp/cakephp, Packagist2.6.0OSV
- cakephp/cakephp, Packagist2.6.0-RC1OSV
- cakephp/cakephp, Packagist2.6.0-betaOSV
- cakephp/cakephp, Packagist2.6.1OSV
- cakephp/cakephp, Packagist2.6.10OSV
- cakephp/cakephp, Packagistfrom 4.6.0, fixed in 4.6.5OSV
- cakephp/cakephp, Packagist4.6.0OSV
- cakephp/cakephp, Packagist4.6.1OSV
- cakephp/cakephp, Packagist4.6.2OSV
- cakephp/cakephp, Packagist4.6.3OSV
- cakephp/cakephp, Packagist4.6.4OSV
- cakephp/cakephp, Packagistfrom 5.0.0, fixed in 5.1.9OSV
- cakephp/cakephp, Packagist5.0.0OSV
- cakephp/cakephp, Packagist5.0.1OSV
- cakephp/cakephp, Packagist5.0.10OSV
- cakephp/cakephp, Packagist5.0.11OSV
- cakephp/cakephp, Packagist5.0.2OSV
- cakephp/cakephp, Packagist5.0.3OSV
- cakephp/cakephp, Packagist5.0.4OSV
- cakephp/cakephp, Packagist5.0.5OSV
- cakephp/cakephp, Packagist5.0.6OSV
- cakephp/cakephp, Packagist5.0.7OSV
- cakephp/cakephp, Packagist5.0.8OSV
- cakephp/cakephp, Packagist5.0.9OSV
- cakephp/cakephp, Packagist5.1.0OSV
- cakephp/cakephp, Packagist5.1.0-RC1OSV
- cakephp/cakephp, Packagist5.1.0-RC2OSV
- cakephp/cakephp, Packagist5.1.1OSV
- cakephp/cakephp, Packagist5.1.2OSV
- cakephp/cakephp, Packagist5.1.4OSV
- cakephp/cakephp, Packagist5.1.5OSV
- cakephp/cakephp, Packagist5.1.6OSV
- cakephp/cakephp, Packagist5.1.7OSV
- cakephp/cakephp, Packagist5.1.8OSV
- cakephp/cakephp, Packagistfrom 5.2.0, fixed in 5.2.14OSV
- cakephp/cakephp, Packagist5.2.0OSV
- cakephp/cakephp, Packagist5.2.1OSV
- cakephp/cakephp, Packagist5.2.10OSV
- cakephp/cakephp, Packagist5.2.11OSV
- cakephp/cakephp, Packagist5.2.12OSV
- cakephp/cakephp, Packagist5.2.13OSV
- cakephp/cakephp, Packagist5.2.2OSV
- cakephp/cakephp, Packagist5.2.3OSV
- cakephp/cakephp, Packagist5.2.4OSV
- cakephp/cakephp, Packagist5.2.5OSV
- cakephp/cakephp, Packagist5.2.6OSV
- cakephp/cakephp, Packagist5.2.7OSV
- cakephp/cakephp, Packagist5.2.8OSV
- cakephp/cakephp, Packagist5.2.9OSV
- cakephp/cakephp, Packagistfrom 5.3.0, fixed in 5.3.7OSV
- cakephp/cakephp, Packagist5.3.0OSV
- cakephp/cakephp, Packagist5.3.1OSV
- cakephp/cakephp, Packagist5.3.2OSV
- cakephp/cakephp, Packagist5.3.3OSV
- cakephp/cakephp, Packagist5.3.4OSV
- cakephp/cakephp, Packagist5.3.5OSV
- cakephp/cakephp, Packagist5.3.6OSV
References 17
- github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0Fixvia CVE List
- github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2eFixvia CVE List
- github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676Fixvia CVE List
- github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7dFixvia CVE List
- github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45Fixvia CVE List
- github.com/cakephp/cakephp/releases/tag/4.5.12Fixvia CVE List
- github.com/cakephp/cakephp/releases/tag/4.6.5Fixvia CVE List
- github.com/cakephp/cakephp/releases/tag/5.1.8Fixvia GitHub
- github.com/cakephp/cakephp/releases/tag/5.1.9Fixvia CVE List
- github.com/cakephp/cakephp/releases/tag/5.2.14Fixvia CVE List
- github.com/cakephp/cakephp/releases/tag/5.3.7Fixvia CVE List
- github.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71Fixvia GitHub
- github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvfAdvisoryvia CVE List
- github.com/advisories/GHSA-vjqc-q4mp-2rvfAdvisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-79752Referencevia GitHub
- github.com/cakephp/cakephp/pull/19520Referencevia CVE List
- github.com/cakephp/cakephp/pull/19528Referencevia CVE List