{"id":"GHSA-qh8m-9qxx-53m5","aliases":["CVE-2026-23643"],"title":"CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\nThe `PaginatorHelper::limitControl()` method has a cross-site-scripting vulnerability via query string parameter manipulation.\n\n### Patches\nThis issue has been fixed in 5.2.12 and 5.3.1\n\n### Workarounds\nIf you are unable to upgrade, you should avoid using `Paginator::limitControl()` until you can upgrade.","severity":"medium","score":5.4,"published":"2026-01-16T21:00:44.000Z","modified":"2026-02-03T03:11:17.661Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"cakephp/cakephp","sources":[{"name":"OSV · GHSA-qh8m-9qxx-53m5","url":"https://osv.dev/vulnerability/GHSA-qh8m-9qxx-53m5"}],"ranges":[{"events":[{"introduced":"5.2.10"},{"fixed":"5.2.12"}],"type":"ECOSYSTEM"}],"versions":["5.2.10","5.2.11"],"fixed":["5.2.12"]},{"ecosystem":"Packagist","name":"cakephp/cakephp","sources":[{"name":"OSV · GHSA-qh8m-9qxx-53m5","url":"https://osv.dev/vulnerability/GHSA-qh8m-9qxx-53m5"}],"ranges":[{"events":[{"introduced":"5.3.0"},{"fixed":"5.3.1"}],"type":"ECOSYSTEM"}],"versions":["5.3.0"],"fixed":["5.3.1"]}],"sourceAffected":[],"references":["https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5","https://nvd.nist.gov/vuln/detail/CVE-2026-23643","https://github.com/cakephp/cakephp/issues/19172","https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f","https://bakery.cakephp.org/2026/01/14/cakephp_5212.html","https://github.com/cakephp/cakephp","https://github.com/cakephp/cakephp/releases/tag/5.2.12","https://github.com/cakephp/cakephp/releases/tag/5.3.1"],"sources":[{"name":"OSV","id":"GHSA-qh8m-9qxx-53m5","modified":"2026-02-03T03:11:17.661769Z","url":"https://osv.dev/vulnerability/GHSA-qh8m-9qxx-53m5"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:30:33.887Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}