CakePHP: View::element() is missing a path containment check
Impact
View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 5.3.0 before 5.3.6Ecosystem versions | 5.3.6 |
| From 5.2.0 before 5.2.13Ecosystem versions | 5.2.13 |
| From 5.0.0 before 5.1.7Ecosystem versions | 5.1.7 |
| From 4.6.0 before 4.6.4Ecosystem versions | 4.6.4 |
| Earlier releases before 4.5.11Ecosystem versions | 4.5.11 |
Version evidence: OSV · GHSA-wpvj-hjcr-h3p2
View original version evidence (432 explicit versions)
Original source description
Impact
View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.
Patches
Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Workarounds
If developers are not using user-supplied data in element names, no action is required.