Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-119418critical9.2

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Impact

CakePHP through 5.4.3 has a SQL injection vulnerability via WindowExpression range() and frame(), allowing attackers to inject SQL by supplying unvalidated frame offsets and directions. Attackers can pass crafted values through applications forwarding user input into the OVER clause. This executes SQL with the database connection's privileges.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

cakephp · VulnCheck

cakephp

1 range
VulnCheck version evidence

Package identity

pkg:composer/cakephp/cakephpExplore cakephp/cakephp →

Identity supplied by VulnCheck. Version matching requires compatible range evidence.

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → through 5.4.3

semver versions

unaffected

unknown

Other versions: unaffected

Original source description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

Inside the record

Evidence available

Package identity
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-119418

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-89 ↗

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

VulnCheck

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

VulnCheck · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*

Through (inclusive): 5.4.3

Original applicability statements
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "5.4.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 2
VulnCheck

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
  1. CVE · CVE-2026-119418

    Observed 2026-10-30T17:29:38.880Z · upstream updated 2026-10-30T16:04:14.569Z

    Prioritization updated

    before

    []

    after

    [
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T16:03:58.022834Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

9 sources
github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
patchVulnCheck
github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
patchVulnCheck
github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
patchVulnCheck
github.com/cakephp/cakephp/pull/19735
patchVulnCheck
github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php
technical-descriptionVulnCheck
github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php
technical-descriptionVulnCheck
View 3 more references
abraxaslabs.tech/research/cakephp-window-sqli
third-party-advisoryVulnCheck
github.com/cakephp/cakephp
productVulnCheck
www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
third-party-advisoryVulnCheck