Skip to content
Threat Feed
Subscribe
critical advisory PoC

SQL Injection Vulnerability in CakePHP FunctionsBuilder

Multiple methods in the CakePHP FunctionsBuilder component are vulnerable to SQL injection when user-supplied input is passed to specific functional parameters.

CVE search metadata

CVE search record: CVE-2026-79752. EPSS: 0.46%. KEV: no. Product: cakephp/database (< 4.5.12, >= 4.6.0 < 4.6.5, >= 5.0.0 < 5.1.9, >= 5.2.0 < 5.2.14, >= 5.3.0 < 5.3.7), cakephp/cakephp (< 4.5.12, >= 4.6.0 < 4.6.5, >= 5.0.0 < 5.1.9, >= 5.2.0 < 5.2.14, >= 5.3.0 < 5.3.7). Brief: SQL Injection Vulnerability in CakePHP FunctionsBuilder. Brief link: https://feed.craftedsignal.io/briefs/2026-09-cakephp-sql-injection/

Triage facts

Revision 1
Applicability
cakephp/database (< 4.5.12, >= 4.6.0 < 4.6.5, >= 5.0.0 < 5.1.9, >= 5.2.0 < 5.2.14, >= 5.3.0 < 5.3.7), cakephp/cakephp (< 4.5.12, >= 4.6.0 < 4.6.5, >= 5.0.0 < 5.1.9, >= 5.2.0 < 5.2.14, >= 5.3.0 < 5.3.7)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Sep 18, 01:10 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

What's new

  • 1. poc_available Sep 19, 21:59 via sploitus

The CakePHP framework contains a critical SQL injection vulnerability (CVE-2026-79752) affecting the FunctionsBuilder component. The vulnerability exists in the cast($field, $dataType), extract($part, $expr), datePart($part, $expr), and dateAdd($expr, $value, $unit) methods. An attacker can exploit this flaw by supplying malicious user-controlled input to the $dataType, $part, or $unit parameters of these functions. If an application fails to sanitize or validate input before passing it to these parameters, an attacker can manipulate the resulting SQL query, potentially leading to unauthorized database access, data exfiltration, or modification. This issue impacts multiple versions of the cakephp/database and cakephp/cakephp packages across the 4.x and 5.x branches. Organizations using these versions are encouraged to update to the patched releases immediately.

Impact

Successful exploitation of this vulnerability allows unauthenticated or authenticated attackers to execute arbitrary SQL commands against the database used by the CakePHP application. The impact includes the potential for full database compromise, unauthorized disclosure of sensitive information, and loss of data integrity. All applications leveraging the vulnerable FunctionsBuilder methods with dynamic user input are at risk, regardless of the sector.

Recommendation

  • Upgrade the cakephp/database and cakephp/cakephp packages to the versions containing the security fix: 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12.
  • Audit existing application code to identify any instances where user-supplied data is passed directly into FunctionsBuilder methods without strict validation or allowlisting.
  • Implement a temporary workaround by ensuring that all user-supplied data passed to cast, extract, datePart, and dateAdd parameters is hardcoded or strictly filtered against a known-safe list of values before function invocation.

Mitigations

Upgrade cakephp/database and cakephp/cakephp to 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12.

immediate IT Operations

CVE-2026-79752