SQL Injection Vulnerability in CakePHP by Cake Software Foundation

CVE-2026-119418

What is CVE-2026-119418?

CakePHP versions up to 5.4.3 are susceptible to an SQL injection vulnerability. This issue arises when unvalidated frame offsets and directions are supplied to the WindowExpression::range() and frame() methods, enabling attackers to inject malicious SQL commands. By exploiting this vulnerability, attackers can manipulate query execution within the database, potentially gaining unauthorized access to sensitive data or executing harmful actions under the database connection's privileges. It is crucial for developers using affected versions to apply available patches to mitigate this risk.

References