PHP Framework Vulnerability in CakePHP Affecting Multiple Versions
CVE-2026-48820

6.3MEDIUM

Key Information:

Vendor

CakePHP

Status
CakePHP
Vendor
CVE Published:
17 June 2026

What is CVE-2026-48820?

CakePHP, a popular rapid development framework for PHP, has a vulnerability in the View::_getElementFileName() function. This issue arises in versions 4.5.11 and earlier, as well as in 4.6.0 to 4.6.3, and in the 5.x series up to 5.3.5. It occurs because the function fails to validate that the resolved element path is contained within designated application or plugin view template paths. Attackers can exploit this weakness by manipulating user-supplied data to gain access to additional PHP files hosted on the server, potentially leading to unauthorized exposure of sensitive information. It is crucial for users to upgrade to the patched versions 5.3.6, 5.2.13, 5.1.7, 4.6.4, or 4.5.12 to mitigate this risk.

Affected Version(s)

cakephp >= 5.3.0, < 5.3.6 < 5.3.0, 5.3.6

cakephp >= 5.2.0, < 5.2.13 < 5.2.0, 5.2.13

cakephp >= 5.0.0, < 5.1.7 < 5.0.0, 5.1.7

References

https://github.com/cakephp/cakephp/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.