CVE-2026-48820: CakePHP: View::element() is missing a path containment check

June 26, 2026

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

References

github.com/advisories/GHSA-wpvj-hjcr-h3p2
github.com/cakephp/cakephp/security/advisories/GHSA-wpvj-hjcr-h3p2
nvd.nist.gov/vuln/detail/CVE-2026-48820

Code Behaviors & Features

Detect and mitigate CVE-2026-48820 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →