CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
The advisory, in context
Impact
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds
Don't provide user controlled data to these functions/parameters.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.0.0 before 4.5.12
Fixed in 4.5.12
271 explicitly affected versions
3.0.0, 3.0.1, 3.0.10, 3.0.12, 3.0.13, 3.0.15, 3.0.18, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC1, 3.1.0-beta, 3.1.0-beta2, 3.1.1, 3.1.10, 3.1.13, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.10.0, 3.10.0-RC1, 3.10.1, 3.10.3, 3.10.4, 3.10.5, 3.2.0, 3.2.0-RC1, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.3.0, 3.3.0-RC1, 3.3.0-beta, 3.3.0-beta2, 3.3.0-beta3, 3.3.1, 3.3.10, 3.3.11, 3.3.12, 3.3.13, 3.3.14, 3.3.15, 3.3.16, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.0, 3.4.0-RC1, 3.4.0-RC2, 3.4.0-RC3, 3.4.0-RC4, 3.4.0-beta1, 3.4.0-beta2, 3.4.0-beta3, 3.4.0-beta4, 3.4.1, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.5.0, 3.5.0-RC1, 3.5.0-RC2, 3.5.1, 3.5.10, 3.5.11, 3.5.12, 3.5.13, 3.5.14, 3.5.15, 3.5.17, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.6.0, 3.6.0-RC1, 3.6.0-RC2, 3.6.0-beta1, 3.6.0-beta2, 3.6.0-beta3, 3.6.1, 3.6.10, 3.6.11, 3.6.12, 3.6.13, 3.6.14, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.7.0, 3.7.0-RC1, 3.7.0-RC2, 3.7.0-RC3, 3.7.0-beta1, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 3.7.9, 3.8.0, 3.8.0-RC1, 3.8.0-RC2, 3.8.0-RC3, 3.8.0-beta1, 3.8.1, 3.8.10, 3.8.11, 3.8.12, 3.8.13, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9.0, 3.9.0-RC1, 3.9.0-RC2, 3.9.1, 3.9.10, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 3.9.8, 3.9.9, 4.0.0, 4.0.0-RC1, 4.0.0-RC2, 4.0.0-alpha1, 4.0.0-beta1, 4.0.0-beta2, 4.0.0-beta3, 4.0.0-beta4, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.0-RC1, 4.1.0-RC2, 4.1.0-beta1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.2.0, 4.2.0-RC1, 4.2.0-beta1, 4.2.1, 4.2.10, 4.2.11, 4.2.12, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.3.0, 4.3.0-RC1, 4.3.0-RC2, 4.3.0-RC3, 4.3.0-RC4, 4.3.1, 4.3.10, 4.3.11, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.4.0, 4.4.0-RC1, 4.4.0-RC2, 4.4.1, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.4.17, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.5.0, 4.5.0-RC1, 4.5.1, 4.5.10, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8, 4.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "4.5.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.10",
"3.0.12",
"3.0.13",
"3.0.15",
"3.0.18",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.0-RC1",
"3.1.0-beta",
"3.1.0-beta2",
"3.1.1",
"3.1.10",
"3.1.13",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.10.0",
"3.10.0-RC1",
"3.10.1",
"3.10.3",
"3.10.4",
"3.10.5",
"3.2.0",
"3.2.0-RC1",
"3.2.1",
"3.2.10",
"3.2.11",
"3.2.12",
"3.2.13",
"3.2.14",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.0",
"3.3.0-RC1",
"3.3.0-beta",
"3.3.0-beta2",
"3.3.0-beta3",
"3.3.1",
"3.3.10",
"3.3.11",
"3.3.12",
"3.3.13",
"3.3.14",
"3.3.15",
"3.3.16",
"3.3.2",
"3.3.3",
"3.3.4",
"3.3.5",
"3.3.6",
"3.3.7",
"3.3.8",
"3.3.9",
"3.4.0",
"3.4.0-RC1",
"3.4.0-RC2",
"3.4.0-RC3",
"3.4.0-RC4",
"3.4.0-beta1",
"3.4.0-beta2",
"3.4.0-beta3",
"3.4.0-beta4",
"3.4.1",
"3.4.10",
"3.4.11",
"3.4.12",
"3.4.13",
"3.4.14",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.4.9",
"3.5.0",
"3.5.0-RC1",
"3.5.0-RC2",
"3.5.1",
"3.5.10",
"3.5.11",
"3.5.12",
"3.5.13",
"3.5.14",
"3.5.15",
"3.5.17",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.7",
"3.5.8",
"3.5.9",
"3.6.0",
"3.6.0-RC1",
"3.6.0-RC2",
"3.6.0-beta1",
"3.6.0-beta2",
"3.6.0-beta3",
"3.6.1",
"3.6.10",
"3.6.11",
"3.6.12",
"3.6.13",
"3.6.14",
"3.6.2",
"3.6.3",
"3.6.4",
"3.6.5",
"3.6.6",
"3.6.7",
"3.6.8",
"3.6.9",
"3.7.0",
"3.7.0-RC1",
"3.7.0-RC2",
"3.7.0-RC3",
"3.7.0-beta1",
"3.7.1",
"3.7.2",
"3.7.3",
"3.7.4",
"3.7.5",
"3.7.6",
"3.7.7",
"3.7.8",
"3.7.9",
"3.8.0",
"3.8.0-RC1",
"3.8.0-RC2",
"3.8.0-RC3",
"3.8.0-beta1",
"3.8.1",
"3.8.10",
"3.8.11",
"3.8.12",
"3.8.13",
"3.8.2",
"3.8.3",
"3.8.4",
"3.8.5",
"3.8.6",
"3.8.7",
"3.8.8",
"3.8.9",
"3.9.0",
"3.9.0-RC1",
"3.9.0-RC2",
"3.9.1",
"3.9.10",
"3.9.2",
"3.9.3",
"3.9.4",
"3.9.5",
"3.9.6",
"3.9.7",
"3.9.8",
"3.9.9",
"4.0.0",
"4.0.0-RC1",
"4.0.0-RC2",
"4.0.0-alpha1",
"4.0.0-beta1",
"4.0.0-beta2",
"4.0.0-beta3",
"4.0.0-beta4",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.0-RC1",
"4.1.0-RC2",
"4.1.0-beta1",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.1.5",
"4.1.6",
"4.1.7",
"4.2.0",
"4.2.0-RC1",
"4.2.0-beta1",
"4.2.1",
"4.2.10",
"4.2.11",
"4.2.12",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.2.6",
"4.2.7",
"4.2.8",
"4.2.9",
"4.3.0",
"4.3.0-RC1",
"4.3.0-RC2",
"4.3.0-RC3",
"4.3.0-RC4",
"4.3.1",
"4.3.10",
"4.3.11",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.7",
"4.3.8",
"4.3.9",
"4.4.0",
"4.4.0-RC1",
"4.4.0-RC2",
"4.4.1",
"4.4.10",
"4.4.11",
"4.4.12",
"4.4.13",
"4.4.14",
"4.4.15",
"4.4.16",
"4.4.17",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5",
"4.4.6",
"4.4.7",
"4.4.8",
"4.4.9",
"4.5.0",
"4.5.0-RC1",
"4.5.1",
"4.5.10",
"4.5.2",
"4.5.3",
"4.5.4",
"4.5.5",
"4.5.6",
"4.5.7",
"4.5.8",
"4.5.9"
]
}From 4.6.0 before 4.6.5
Fixed in 4.6.5
4 explicitly affected versions
4.6.0, 4.6.1, 4.6.2, 4.6.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.6.0",
"4.6.1",
"4.6.2",
"4.6.3"
]
}From 5.0.0 before 5.1.9
Fixed in 5.1.9
20 explicitly affected versions
5.0.0, 5.0.10, 5.0.11, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.1.0, 5.1.0-RC1, 5.1.0-RC2, 5.1.1, 5.1.2, 5.1.4, 5.1.5, 5.1.6, 5.1.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0",
"5.0.10",
"5.0.11",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.0.6",
"5.0.7",
"5.0.8",
"5.0.9",
"5.1.0",
"5.1.0-RC1",
"5.1.0-RC2",
"5.1.1",
"5.1.2",
"5.1.4",
"5.1.5",
"5.1.6",
"5.1.8"
]
}From 5.2.0 before 5.2.14
Fixed in 5.2.14
14 explicitly affected versions
5.2.0, 5.2.1, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.2.0",
"5.2.1",
"5.2.10",
"5.2.11",
"5.2.12",
"5.2.13",
"5.2.2",
"5.2.3",
"5.2.4",
"5.2.5",
"5.2.6",
"5.2.7",
"5.2.8",
"5.2.9"
]
}From 5.3.0 before 5.3.7
Fixed in 5.3.7
6 explicitly affected versions
5.3.0, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.3.0",
"5.3.2",
"5.3.3",
"5.3.4",
"5.3.5",
"5.3.6"
]
}Earlier releases before 4.5.12
Fixed in 4.5.12
390 explicitly affected versions
2.10.0, 2.10.0-RC1, 2.10.1, 2.10.10, 2.10.11, 2.10.12, 2.10.13, 2.10.14, 2.10.15, 2.10.16, 2.10.17, 2.10.18, 2.10.19, 2.10.2, 2.10.20, 2.10.21, 2.10.22, 2.10.23, 2.10.24, 2.10.3, 2.10.4, 2.10.5, 2.10.6, 2.10.7, 2.10.8, 2.10.9, 2.4.10, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.5.0, 2.5.0-RC1, 2.5.0-RC2, 2.5.0-beta, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.5.8, 2.5.9, 2.6.0, 2.6.0-RC1, 2.6.0-beta, 2.6.1, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.7.0, 2.7.0-RC, 2.7.1, 2.7.10, 2.7.11, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7, 2.7.8, 2.7.9, 2.8.0, 2.8.0-RC1, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-RC1, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC1, 3.0.0-RC2, 3.0.0-alpha1, 3.0.0-alpha2, 3.0.0-beta1, 3.0.0-beta2, 3.0.0-beta3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC1, 3.1.0-beta, 3.1.0-beta2, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.10.0, 3.10.0-RC1, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.10.5, 3.2.0, 3.2.0-RC1, 3.2.1, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.3.0, 3.3.0-RC1, 3.3.0-beta, 3.3.0-beta2, 3.3.0-beta3, 3.3.1, 3.3.10, 3.3.11, 3.3.12, 3.3.13, 3.3.14, 3.3.15, 3.3.16, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.0, 3.4.0-RC1, 3.4.0-RC2, 3.4.0-RC3, 3.4.0-RC4, 3.4.0-beta1, 3.4.0-beta2, 3.4.0-beta3, 3.4.0-beta4, 3.4.1, 3.4.10, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 3.5.0, 3.5.0-RC1, 3.5.0-RC2, 3.5.1, 3.5.10, 3.5.11, 3.5.12, 3.5.13, 3.5.14, 3.5.15, 3.5.16, 3.5.17, 3.5.18, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.6.0, 3.6.0-RC1, 3.6.0-RC2, 3.6.0-beta1, 3.6.0-beta2, 3.6.0-beta3, 3.6.1, 3.6.10, 3.6.11, 3.6.12, 3.6.13, 3.6.14, 3.6.15, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.7.0, 3.7.0-RC1, 3.7.0-RC2, 3.7.0-RC3, 3.7.0-beta1, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8, 3.7.9, 3.8.0, 3.8.0-RC1, 3.8.0-RC2, 3.8.0-RC3, 3.8.0-beta1, 3.8.1, 3.8.10, 3.8.11, 3.8.12, 3.8.13, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9.0, 3.9.0-RC1, 3.9.0-RC2, 3.9.1, 3.9.10, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 3.9.8, 3.9.9, 4.0.0, 4.0.0-RC1, 4.0.0-RC2, 4.0.0-alpha1, 4.0.0-alpha2, 4.0.0-beta1, 4.0.0-beta2, 4.0.0-beta3, 4.0.0-beta4, 4.0.1, 4.0.10, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.0-RC1, 4.1.0-RC2, 4.1.0-beta1, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.2.0, 4.2.0-RC1, 4.2.0-beta1, 4.2.1, 4.2.10, 4.2.11, 4.2.12, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.3.0, 4.3.0-RC1, 4.3.0-RC2, 4.3.0-RC3, 4.3.0-RC4, 4.3.1, 4.3.10, 4.3.11, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.4.0, 4.4.0-RC1, 4.4.0-RC2, 4.4.1, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.4.17, 4.4.18, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.5.0, 4.5.0-RC1, 4.5.1, 4.5.10, 4.5.11, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8, 4.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.10.0",
"2.10.0-RC1",
"2.10.1",
"2.10.10",
"2.10.11",
"2.10.12",
"2.10.13",
"2.10.14",
"2.10.15",
"2.10.16",
"2.10.17",
"2.10.18",
"2.10.19",
"2.10.2",
"2.10.20",
"2.10.21",
"2.10.22",
"2.10.23",
"2.10.24",
"2.10.3",
"2.10.4",
"2.10.5",
"2.10.6",
"2.10.7",
"2.10.8",
"2.10.9",
"2.4.10",
"2.4.5",
"2.4.6",
"2.4.7",
"2.4.8",
"2.4.9",
"2.5.0",
"2.5.0-RC1",
"2.5.0-RC2",
"2.5.0-beta",
"2.5.1",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.5.6",
"2.5.7",
"2.5.8",
"2.5.9",
"2.6.0",
"2.6.0-RC1",
"2.6.0-beta",
"2.6.1",
"2.6.10",
"2.6.11",
"2.6.12",
"2.6.13",
"2.6.2",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.6.7",
"2.6.8",
"2.6.9",
"2.7.0",
"2.7.0-RC",
"2.7.1",
"2.7.10",
"2.7.11",
"2.7.2",
"2.7.3",
"2.7.4",
"2.7.5",
"2.7.6",
"2.7.7",
"2.7.8",
"2.7.9",
"2.8.0",
"2.8.0-RC1",
"2.8.1",
"2.8.2",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.0-RC1",
"2.9.1",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9",
"3.0.0",
"3.0.0-RC1",
"3.0.0-RC2",
"3.0.0-alpha1",
"3.0.0-alpha2",
"3.0.0-beta1",
"3.0.0-beta2",
"3.0.0-beta3",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.17",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.0-RC1",
"3.1.0-beta",
"3.1.0-beta2",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.12",
"3.1.13",
"3.1.14",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.10.0",
"3.10.0-RC1",
"3.10.1",
"3.10.2",
"3.10.3",
"3.10.4",
"3.10.5",
"3.2.0",
"3.2.0-RC1",
"3.2.1",
"3.2.10",
"3.2.11",
"3.2.12",
"3.2.13",
"3.2.14",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.0",
"3.3.0-RC1",
"3.3.0-beta",
"3.3.0-beta2",
"3.3.0-beta3",
"3.3.1",
"3.3.10",
"3.3.11",
"3.3.12",
"3.3.13",
"3.3.14",
"3.3.15",
"3.3.16",
"3.3.2",
"3.3.3",
"3.3.4",
"3.3.5",
"3.3.6",
"3.3.7",
"3.3.8",
"3.3.9",
"3.4.0",
"3.4.0-RC1",
"3.4.0-RC2",
"3.4.0-RC3",
"3.4.0-RC4",
"3.4.0-beta1",
"3.4.0-beta2",
"3.4.0-beta3",
"3.4.0-beta4",
"3.4.1",
"3.4.10",
"3.4.11",
"3.4.12",
"3.4.13",
"3.4.14",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.4.9",
"3.5.0",
"3.5.0-RC1",
"3.5.0-RC2",
"3.5.1",
"3.5.10",
"3.5.11",
"3.5.12",
"3.5.13",
"3.5.14",
"3.5.15",
"3.5.16",
"3.5.17",
"3.5.18",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.7",
"3.5.8",
"3.5.9",
"3.6.0",
"3.6.0-RC1",
"3.6.0-RC2",
"3.6.0-beta1",
"3.6.0-beta2",
"3.6.0-beta3",
"3.6.1",
"3.6.10",
"3.6.11",
"3.6.12",
"3.6.13",
"3.6.14",
"3.6.15",
"3.6.2",
"3.6.3",
"3.6.4",
"3.6.5",
"3.6.6",
"3.6.7",
"3.6.8",
"3.6.9",
"3.7.0",
"3.7.0-RC1",
"3.7.0-RC2",
"3.7.0-RC3",
"3.7.0-beta1",
"3.7.1",
"3.7.2",
"3.7.3",
"3.7.4",
"3.7.5",
"3.7.6",
"3.7.7",
"3.7.8",
"3.7.9",
"3.8.0",
"3.8.0-RC1",
"3.8.0-RC2",
"3.8.0-RC3",
"3.8.0-beta1",
"3.8.1",
"3.8.10",
"3.8.11",
"3.8.12",
"3.8.13",
"3.8.2",
"3.8.3",
"3.8.4",
"3.8.5",
"3.8.6",
"3.8.7",
"3.8.8",
"3.8.9",
"3.9.0",
"3.9.0-RC1",
"3.9.0-RC2",
"3.9.1",
"3.9.10",
"3.9.2",
"3.9.3",
"3.9.4",
"3.9.5",
"3.9.6",
"3.9.7",
"3.9.8",
"3.9.9",
"4.0.0",
"4.0.0-RC1",
"4.0.0-RC2",
"4.0.0-alpha1",
"4.0.0-alpha2",
"4.0.0-beta1",
"4.0.0-beta2",
"4.0.0-beta3",
"4.0.0-beta4",
"4.0.1",
"4.0.10",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.0-RC1",
"4.1.0-RC2",
"4.1.0-beta1",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.1.5",
"4.1.6",
"4.1.7",
"4.2.0",
"4.2.0-RC1",
"4.2.0-beta1",
"4.2.1",
"4.2.10",
"4.2.11",
"4.2.12",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.2.6",
"4.2.7",
"4.2.8",
"4.2.9",
"4.3.0",
"4.3.0-RC1",
"4.3.0-RC2",
"4.3.0-RC3",
"4.3.0-RC4",
"4.3.1",
"4.3.10",
"4.3.11",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.7",
"4.3.8",
"4.3.9",
"4.4.0",
"4.4.0-RC1",
"4.4.0-RC2",
"4.4.1",
"4.4.10",
"4.4.11",
"4.4.12",
"4.4.13",
"4.4.14",
"4.4.15",
"4.4.16",
"4.4.17",
"4.4.18",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5",
"4.4.6",
"4.4.7",
"4.4.8",
"4.4.9",
"4.5.0",
"4.5.0-RC1",
"4.5.1",
"4.5.10",
"4.5.11",
"4.5.2",
"4.5.3",
"4.5.4",
"4.5.5",
"4.5.6",
"4.5.7",
"4.5.8",
"4.5.9"
]
}From 4.6.0 before 4.6.5
Fixed in 4.6.5
5 explicitly affected versions
4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.6.0",
"4.6.1",
"4.6.2",
"4.6.3",
"4.6.4"
]
}From 5.0.0 before 5.1.9
Fixed in 5.1.9
22 explicitly affected versions
5.0.0, 5.0.1, 5.0.10, 5.0.11, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.1.0, 5.1.0-RC1, 5.1.0-RC2, 5.1.1, 5.1.2, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0",
"5.0.1",
"5.0.10",
"5.0.11",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.0.6",
"5.0.7",
"5.0.8",
"5.0.9",
"5.1.0",
"5.1.0-RC1",
"5.1.0-RC2",
"5.1.1",
"5.1.2",
"5.1.4",
"5.1.5",
"5.1.6",
"5.1.7",
"5.1.8"
]
}From 5.2.0 before 5.2.14
Fixed in 5.2.14
14 explicitly affected versions
5.2.0, 5.2.1, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.2.0",
"5.2.1",
"5.2.10",
"5.2.11",
"5.2.12",
"5.2.13",
"5.2.2",
"5.2.3",
"5.2.4",
"5.2.5",
"5.2.6",
"5.2.7",
"5.2.8",
"5.2.9"
]
}From 5.3.0 before 5.3.7
Fixed in 5.3.7
7 explicitly affected versions
5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.3.0",
"5.3.1",
"5.3.2",
"5.3.3",
"5.3.4",
"5.3.5",
"5.3.6"
]
}References
- https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- https://nvd.nist.gov/vuln/detail/CVE-2026-79752
- https://github.com/cakephp/cakephp/pull/19528
- https://github.com/cakephp/cakephp/pull/19520
- https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- https://github.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71
- https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- https://github.com/cakephp/cakephp/releases/tag/4.5.12
- https://github.com/cakephp/cakephp/releases/tag/4.6.5
- https://github.com/cakephp/cakephp/releases/tag/5.1.8
- https://github.com/cakephp/cakephp/releases/tag/5.1.9
- https://github.com/cakephp/cakephp/releases/tag/5.2.14
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp