SQL Injection Vulnerability in CakePHP Framework
CVE-2026-79752
9.2CRITICAL
What is CVE-2026-79752?
The CakePHP framework has a vulnerability in its FunctionsBuilder class that allows user-controlled values for dataType, part, or unit to be included in generated SQL queries as unescaped components. This can lead to SQL injection attacks, compromising the confidentiality, integrity, and availability of the database, depending on the privileges granted to the database connection. It is crucial for applications using affected versions to update to 4.5.12, 4.6.5, 5.1.9, 5.2.14, or 5.3.7 to mitigate this risk.
Affected Version(s)
cakephp < 4.5.12 < 4.5.12
cakephp >= 4.6.0, < 4.6.5 < 4.6.0, 4.6.5
cakephp >= 5.0.0, < 5.1.9 < 5.0.0, 5.1.9