SQL Injection Vulnerability in CakePHP Framework Affecting PostgreSQL Driver
CVE-2026-77635
What is CVE-2026-77635?
CVE-2026-77635 is a significant SQL injection vulnerability affecting the CakePHP framework, specifically its PostgreSQL driver. CakePHP is a widely used rapid development framework for PHP that enables developers to create web applications efficiently. This vulnerability arises from the way the FunctionsBuilder::jsonValue() method handles user-controlled data in the jsonPath parameter. If exploited, it allows attackers to inject malicious SQL queries, potentially leading to unauthorized access to the database and manipulation of its contents. This poses a serious risk to organizations that rely on CakePHP for their web applications, as it could result in data breaches, loss of data integrity, and significant reputational damage.
Potential impact of CVE-2026-77635
-
Data Breach and Exfiltration: The SQL injection vulnerability allows attackers to access sensitive data stored in the database. This could lead to the exposure of customer information, trade secrets, and other confidential resources, compromising organizational privacy and customer trust.
-
Database Manipulation: Successful exploitation of the vulnerability may enable unauthorized modifications to the database, including data deletion, alteration, or insertion of malicious content. Such manipulation can disrupt business operations and lead to data integrity issues.
-
Increased Attack Surface: As the vulnerability is not actively exploited in the wild, there is a concern that it could attract malicious actors, especially as knowledge of the flaw becomes more widespread. This can lead to future attacks, increasing the risk for organizations that have not yet applied the necessary patches.
Affected Version(s)
cakephp >= 5.1.0, < 5.1.10 < 5.1.0, 5.1.10
cakephp >= 5.2.0, < 5.2.15 < 5.2.0, 5.2.15
cakephp >= 5.3.0, < 5.3.7 < 5.3.0, 5.3.7