GitHub Advisoryadvisory · Packagist

GHSA-fxf7-vhh8-7vpq CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CRITICAL Published 2026-09-08 Modified 2026-09-08 Official page ↗
Aliases
CVE-2026-77635
Ecosystem
Packagist
Packages
cakephp/cakephp, cakephp/database
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-89
Reviewed
2026-09-08

Affected packages

• Packagist cakephp/cakephp: >= 5.3.0, < 5.3.7 → fixed in 5.3.7 • Packagist cakephp/cakephp: >= 5.2.0, < 5.2.15 → fixed in 5.2.15 • Packagist cakephp/cakephp: >= 5.1.0, < 5.1.10 → fixed in 5.1.10 • Packagist cakephp/database: >= 5.3.0, < 5.3.7 → fixed in 5.3.7 • Packagist cakephp/database: >= 5.2.0, < 5.2.15 → fixed in 5.2.15 • Packagist cakephp/database: >= 5.1.0, < 5.1.10 → fixed in 5.1.10

Description

Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. Patches 5.1.10, 5.2.15, 5.3.7 Workarounds Don't provide user controlled data to these functions/parameters.

Related

Alias · CVE (1)

  • CVE-2026-77635 CakePHP is a rapid development framework for PHP. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References