The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote…
Priority MEDIUM 47CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.
Summary
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Why it matters now
EPSS 0.12091 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed cakephp/cakephp (Packagist): 2.1.5, 2.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | cakephp/cakephp (Packagist) | 2.1.0-alpha to before 2.1.5 | 2.1.5 | Patch available | GHSA-5964-pq8r-4q62 |
| — | cakephp/cakephp (Packagist) | 2.2.0-beta to before 2.2.1 | 2.2.1 | Patch available | GHSA-5964-pq8r-4q62 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- cakephp/cakephp (Packagist) Vendor— Affected 2.1.0-alpha to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-5964-pq8r-4q62
- cakephp/cakephp (Packagist) Vendor— Affected 2.2.0-beta to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-5964-pq8r-4q62
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:* | 2.1.0 to before 2.1.5; 2.2.0 to before 2.2.1 | Vulnerable | Cakefoundation |
- cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.1.5; 2.2.0 to before 2.2.1 Vulnerable ·Cakefoundation
Remediation
- Fix · GHSA-5964-pq8r-4q62 cakephp/cakephp (Packagist) Fixed in 2.1.5 Advisory →
- Fix · GHSA-5964-pq8r-4q62 cakephp/cakephp (Packagist) Fixed in 2.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2012-4399
- 2026-10-03 Alias added: GHSA-5964-pq8r-4q62
References
Advisory 2
More Cakefoundation Cakephp vulnerabilities
- TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
- TI-2020-12145 CakePHP before 4.0.6 mishandles CSRF token generation. CVSS 3.1MEDIUM 4.3
Sources
- CVE-2012-4399 · CVE Program
- CVE-2012-4399 · NVD
- FIRST EPSS
- GHSA-5964-pq8r-4q62 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences