CakePHP (<= 5.4.3) - CraftedSignal Threat Feed

CakePHP: SQL injection in StringExpression and IdentifierExpression (CVE-2026-119419)

hello@craftedsignal.io — Fri, 30 Oct 2026 13:29:22 +0000

CakePHP versions 5.4.3 and earlier are susceptible to an SQL injection vulnerability. The flaw exists within the StringExpression and IdentifierExpression classes. Attackers who can control the collation parameter passed to the constructor or the setCollation() method can inject arbitrary SQL commands. The injected payload is appended after the unquoted COLLATE clause and executes with the privileges of the active database connection.

Impact

Successful exploitation allows attackers to execute arbitrary SQL commands against the backend database, potentially resulting in unauthorized data access, modification, or destruction, depending on the privileges of the database user configured in the application.

Recommendation

Audit custom application code using CakePHP to identify instances where user-supplied input is passed to StringExpression, IdentifierExpression, or the setCollation() method.
Implement strict input validation or allow-listing for any collation parameters processed by these methods.
Upgrade to the latest version of CakePHP that includes the security patch for CVE-2026-119419 once available.

CakePHP: SQL injection in WindowExpression (CVE-2026-119418)

hello@craftedsignal.io — Fri, 30 Oct 2026 13:29:14 +0000

CakePHP versions through 5.4.3 contain an SQL injection vulnerability arising from the improper validation of frame offsets and directions within the WindowExpression::range() and frame() methods. Applications that pass user-supplied input into these methods, which are subsequently rendered in the OVER clause of a SQL query, are susceptible to exploitation. An attacker can leverage this flaw to execute unauthorized SQL statements using the privileges of the database connection.

Impact

Successful exploitation allows for unauthorized SQL execution, which can lead to data exfiltration, database modification, or denial of service depending on the application database configuration and privileges.

Recommendation

Inventory all applications utilizing CakePHP versions 5.4.3 or older.
Review custom code for any usage of WindowExpression::range() or frame() that incorporates untrusted user input.
Apply patches or upgrade to a version of CakePHP that addresses this vulnerability once available.
Implement strict input validation and sanitization for all parameters passed to framework query building methods.