GitHub Advisoryadvisory · Packagist

GHSA-wpvj-hjcr-h3p2 CakePHP: View::element() is missing a path containment check

MEDIUM Published 2026-06-26 Modified 2026-06-26 Official page ↗
Aliases
CVE-2026-48820
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-06-26

Affected packages

• Packagist cakephp/cakephp: >= 5.3.0, < 5.3.6 → fixed in 5.3.6 • Packagist cakephp/cakephp: >= 5.2.0, < 5.2.13 → fixed in 5.2.13 • Packagist cakephp/cakephp: >= 5.0.0, < 5.1.7 → fixed in 5.1.7 • Packagist cakephp/cakephp: >= 4.6.0, < 4.6.4 → fixed in 4.6.4 • Packagist cakephp/cakephp: < 4.5.11 → fixed in 4.5.11

Description

Impact `View::_getElementFileName()` does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patches Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11. Workarounds If developers are not using user-supplied data in element names, no action is required.

Related

Alias · CVE (1)

  • CVE-2026-48820 CakePHP is a rapid development framework for PHP. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References