CakePHP: SQL injection in StringExpression and IdentifierExpression (CVE-2026-119419)
CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.
CVE search metadata
CVE search record: CVE-2026-119419. Severity: high. CVSS: 8.1. KEV: no. Product: CakePHP (<= 5.4.3). Brief: CakePHP: SQL injection in StringExpression and IdentifierExpression (CVE-2026-119419). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cakephp-sql-injection-a878a2a5/
Triage facts
Revision 1- Applicability
- CakePHP (<= 5.4.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 13:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CakePHP versions 5.4.3 and earlier are susceptible to an SQL injection vulnerability. The flaw exists within the StringExpression and IdentifierExpression classes. Attackers who can control the collation parameter passed to the constructor or the setCollation() method can inject arbitrary SQL commands. The injected payload is appended after the unquoted COLLATE clause and executes with the privileges of the active database connection.
Impact
Successful exploitation allows attackers to execute arbitrary SQL commands against the backend database, potentially resulting in unauthorized data access, modification, or destruction, depending on the privileges of the database user configured in the application.
Recommendation
- Audit custom application code using CakePHP to identify instances where user-supplied input is passed to
StringExpression,IdentifierExpression, or thesetCollation()method. - Implement strict input validation or allow-listing for any collation parameters processed by these methods.
- Upgrade to the latest version of CakePHP that includes the security patch for CVE-2026-119419 once available.
Immediate actions
Inventory all application instances utilizing CakePHP 5.4.3 or earlier
Threat Hunt
Identify database query logs or WAF logs containing SQL syntax in unexpected fields, specifically near COLLATE clauses
Data: Web application logs, Database query logs
Mitigations
Upgrade CakePHP to the latest patched version
CVE-2026-119419