CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Cakephp
  • Cakephp

No data.

No data.

References
Link Providers
https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45 cve-icon cve-icon
https://github.com/cakephp/cakephp/pull/19520 cve-icon cve-icon
https://github.com/cakephp/cakephp/pull/19528 cve-icon cve-icon
https://github.com/cakephp/cakephp/releases/tag/4.5.12 cve-icon cve-icon
https://github.com/cakephp/cakephp/releases/tag/4.6.5 cve-icon cve-icon
https://github.com/cakephp/cakephp/releases/tag/5.1.9 cve-icon cve-icon
https://github.com/cakephp/cakephp/releases/tag/5.2.14 cve-icon cve-icon
https://github.com/cakephp/cakephp/releases/tag/5.3.7 cve-icon cve-icon
https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf cve-icon cve-icon
History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Cakephp
Cakephp cakephp
Vendors & Products Cakephp
Cakephp cakephp

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Title CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-09-17T14:49:56.936Z

Updated: 2026-09-17T15:20:00.313Z

Reserved: 2026-08-25T14:08:18.109Z

Link: CVE-2026-79752

cve-icon Vulnrichment

Updated: 2026-09-17T15:19:56.933Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-17T15:16:51.673

Modified: 2026-09-30T17:43:24.057

Link: CVE-2026-79752

cve-icon Redhat

No data.