GitHub Advisoryadvisory · Packagist

GHSA-qh8m-9qxx-53m5 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

MEDIUM Published 2026-01-16 Modified 2026-01-16 Official page ↗
Aliases
CVE-2026-23643
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-01-16

Affected packages

• Packagist cakephp/cakephp: >= 5.2.10, < 5.2.12 → fixed in 5.2.12 • Packagist cakephp/cakephp: >= 5.3.0, < 5.3.1 → fixed in 5.3.1

Description

Impact The `PaginatorHelper::limitControl()` method has a cross-site-scripting vulnerability via query string parameter manipulation. Patches This issue has been fixed in 5.2.12 and 5.3.1 Workarounds If you are unable to upgrade, you should avoid using `Paginator::limitControl()` until you can upgrade.

Related

Alias · CVE (1)

  • CVE-2026-23643 CakePHP is a rapid development framework for PHP. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References