CVE-2026-79752: CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
References
- github.com/advisories/GHSA-vjqc-q4mp-2rvf
- github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- github.com/cakephp/cakephp/pull/19520
- github.com/cakephp/cakephp/pull/19528
- github.com/cakephp/cakephp/releases/tag/4.5.12
- github.com/cakephp/cakephp/releases/tag/4.6.5
- github.com/cakephp/cakephp/releases/tag/5.1.8
- github.com/cakephp/cakephp/releases/tag/5.1.9
- github.com/cakephp/cakephp/releases/tag/5.2.14
- github.com/cakephp/cakephp/releases/tag/5.3.7
- github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- nvd.nist.gov/vuln/detail/CVE-2026-79752
Code Behaviors & Features
Detect and mitigate CVE-2026-79752 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →