Read the docs
TI-2020-17913 Aliases CVE-2020-35239GHSA-9pgx-pf36-w46r

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3.

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

Why it matters now

EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed cakephp/cakephp (Packagist): 4.0.10, 4.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—cakephp/cakephp (Packagist)4.0.0 to before 4.0.104.0.10Patch availableGHSA-9pgx-pf36-w46r
—cakephp/cakephp (Packagist)4.1.0 to before 4.1.44.1.4Patch availableGHSA-9pgx-pf36-w46r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • cakephp/cakephp (Packagist) Vendor— Affected 4.0.0 to before 4.0.10 Fixed in 4.0.10 Patch available GHSA-9pgx-pf36-w46r
  • cakephp/cakephp (Packagist) Vendor— Affected 4.1.0 to before 4.1.4 Fixed in 4.1.4 Patch available GHSA-9pgx-pf36-w46r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*4.0.0 – 4.1.3Vulnerablecakephp
  • cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* Versions 4.0.0 – 4.1.3 Vulnerable ·cakephp

Remediation

  • Fix · GHSA-9pgx-pf36-w46r cakephp/cakephp (Packagist) Fixed in 4.0.10 Advisory →
  • Fix · GHSA-9pgx-pf36-w46r cakephp/cakephp (Packagist) Fixed in 4.1.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35239
  2. 2026-10-03 Alias added: GHSA-9pgx-pf36-w46r

References

Advisory 2

Other 1

  • TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
  • TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
  • TI-2023-08901 Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVSS 3.1CRITICAL 9.8
  • TI-2016-04142 The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their… CVSS 3.0HIGH 7.5
  • TI-2015-06899 CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF… CVSS 3.0HIGH 8.8
  • TI-2019-08553 An issue was discovered in SmtpTransport in CakePHP 3.7.6. CVSS 3.0HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences