CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Published September 8, 2026 CVE-2026-77635

CakePHP applications using PostgreSQL can let attackers manipulate database queries. This can expose or alter stored data and disrupt service.

Severity
CriticalCVSS 4.0 · 9.2
Fix
Fixed in 5.1.10Fix recorded 2 days ago
Affected versions
5.1.0 or newer, but before 5.1.10; 5.2.0 or newer, but before 5.2.15; 5.3.0 or newer, but before 5.3.7+3 more
Weakness
CWE-89SQL Injection
Exploit likelihood
0.29% in 30 daysEPSS, higher than 22% of known flaws
Affects
CakePHP+1 more

How it works

  • An application must use CakePHP with PostgreSQL and accept user-controlled JSON path data.
  • CakePHP can place that input into a database query without safely separating it.
  • Crafted query text can then change what the database executes.
  • The supplied evidence does not establish the full route attackers could use.

What to do

Check composer.lock for cakephp/cakephp or cakephp/database, then compare its version with the affected ranges. Also confirm whether the application uses PostgreSQL and passes user input into CakePHP's JSON query feature. A vulnerable package alone does not prove the application is exposed or compromised.

Upgrade the relevant release line to 5.1.10, 5.2.15, or 5.3.7. Until then, do not pass user-controlled data into the affected JSON query arguments. Application maintainers can compare their implementation with the CakePHP advisory.

Technical details

Affected software: CakePHPby cakephp, cakephp/databaseby cakephp

CVE-2026-77635 affects FunctionsBuilder::jsonValue when CakePHP uses PostgresDriver. A user-controlled jsonPath value can alter the generated SQL query instead of remaining ordinary data. Both cakephp/cakephp and cakephp/database are affected across the listed 5.1, 5.2, and 5.3 release ranges.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption Low Reduced performance or interruptions
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source