PT-2026-133471

CVE-2026-119418

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
8.1
High
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.4.3
Description An issue exists where attackers can execute SQL commands with the privileges of the database connection. This occurs when applications forward unvalidated user input into the OVER clause, specifically through the WindowExpression::range() and frame() functions. The flaw allows for the injection of SQL by supplying crafted frame offsets and directions.
Recommendations Update to version 5.4.3 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-119418
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com