SQL injection in CakePHP via unvalidated collation names
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
CakePHP through 5.4.3 contains an SQL injection flaw in StringExpression and IdentifierExpression because collation values are not validated, so SQL can be appended after the unquoted COLLATE clause (CWE-89). An attacker who controls a collation name passed to the constructor or setCollation() can inject SQL over the network without privileges or user interaction, using the connection's database privileges and affecting every database driver.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for cakephp.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119419
- 2026-10-30 Alias added: GHSA-6q38-2qcr-3x34
- 2026-11-04 CISA SSVC decision points changed
References
Patch 5
- https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9
- https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3c
- https://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595
- https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82
- https://github.com/cakephp/cakephp/pull/19726
Other 3
More cakephp vulnerabilities
- TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
- TI-2026-82995 Cookie leakage in CakePHP HTTP client cookie domain matching CVSS 4.0MEDIUM 6.3
- TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
- TI-2023-08901 Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVSS 3.1CRITICAL 9.8
- TI-2026-54106 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVSS 4.0CRITICAL 9.2
- TI-2026-55232 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-119419 · CVE Program
- CVE-2026-119419 · NVD
- FIRST EPSS
- GHSA-6q38-2qcr-3x34 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences