PT-2026-94368

CVE-2026-79752

Published

2026-09-17

Updated

2026-09-19

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.12 CakePHP versions prior to 4.6.5 CakePHP versions prior to 5.1.9 CakePHP versions prior to 5.2.14 CakePHP versions prior to 5.3.7

Description Certain methods in src/Database/FunctionsBuilder.php allow user-controlled values to be incorporated into generated SQL as unescaped structural fragments. This can lead to SQL injection, impacting confidentiality, integrity, and availability based on the database connection privileges. The affected functions and their vulnerable parameters are:

FunctionsBuilder::cast(): dataType
FunctionsBuilder::extract(): part
FunctionsBuilder::datePart(): part
FunctionsBuilder::dateAdd(): unit

Recommendations Update to version 4.5.12 Update to version 4.6.5 Update to version 5.1.9 Update to version 5.2.14 Update to version 5.3.7 Avoid providing user-controlled data to the dataType, part, and unit parameters of the affected functions.

Exploitability

Exploit

Fix

Impacts

Researchers

Unknownhad

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2026-79752