SQL Injection Vulnerability in CakePHP by CakPHP
CVE-2026-119419

9.2CRITICAL

Key Information:

Vendor

CakePHP

Status
CakePHP
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119419?

CakePHP, up to version 5.4.3, is susceptible to an SQL injection vulnerability that arises from inadequately validated collation values provided to StringExpression and IdentifierExpression. Attackers with control over a collated name supplied to the constructor or the setCollation() method can manipulate SQL statements by appending unauthorized commands following the unquoted COLLATE clause. This vulnerability could potentially affect all database drivers permitted within the connection's privileges, leading to unauthorized data access and manipulation.

Affected Version(s)

cakephp 0 <= 5.4.3

References

https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb...
patch
https://github.com/cakephp/cakephp/commit/21951faea40060d...
patch
https://github.com/cakephp/cakephp/commit/d04d342c3d1e0ba...
patch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Mark Story
.