Is cakephp/cakephp 2.6 vulnerable?

Composer · 14 releases from 2.6.0 to 2.6.13 · latest cakephp/cakephp is 5.4.4 · checked 2 Nov 2026

Yes: 4 known advisories

Yes. cakephp/cakephp 2.6.13, the last 2.6 release, is affected by 4 known security advisories (1 critical, 1 high, 2 medium), including CVE-2026-79752, CVE-2015-8379, CVE-2026-48820. 4 more affect earlier 2.6.x releases. Upgrade to 4.5.12 or later to fix all of them.

Upgrade with:composer require cakephp/cakephp:^4.5.12

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting cakephp/cakephp 2.6.13

  • CriticalCVE-2026-79752GHSA-vjqc-q4mp-2rvf17 Sept 2026

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    Affected
    <4.5.12 · >=4.6.0 <4.6.5 · >=5.0.0 <5.1.9 · >=5.2.0 <5.2.14 · >=5.3.0 <5.3.7
    Fixed in
    4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
  • MediumCVE-2026-48820GHSA-wpvj-hjcr-h3p226 Jun 2026

    CakePHP: View::element() is missing a path containment check

    Affected
    >=5.3.0 <5.3.6 · >=5.2.0 <5.2.13 · >=5.0.0 <5.1.7 · >=4.6.0 <4.6.4 · <4.5.11
    Fixed in
    4.5.11, 4.6.4, 5.1.7, 5.2.13, 5.3.6
  • HighCVE-2015-8379GHSA-556q-h4vr-pgh214 May 2022

    CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

    Affected
    >=2.0.0-alpha <3.1.5
    Fixed in
    3.1.5
  • MediumCVE-2020-15400GHSA-j33j-fg2g-mcv210 Feb 2022

    Cross-Site Request Forgery in CakePHP

    Affected
    >=4.0.0 <4.0.6 · <3.10.3
    Fixed in
    3.10.3, 4.0.6

Fixed within 2.6.x, affecting earlier releases

  • MediumGHSA-p76f-wr22-4rv620 Jan 2023

    CakePHP vulnerable to Remote File Inclusion through View template name manipulation

    Affected
    >=2.0.0 <2.0.99 · >=2.1.0 <2.1.99 · >=2.2.0 <2.2.99 · >=2.3.0 <2.3.99 · >=2.4.0 <2.4.99 · >=2.5.0 <2.5.99 · >=2.6.0 <2.6.12 · >=2.7.0 <2.7.6 · >=3.0.0 <3.0.15 · >=3.1.0 <3.1.4
    Fixed in
    2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, 2.7.6, 3.0.15, 3.1.4
  • MediumGHSA-6hg4-vp5q-47mw20 Jan 2023

    CakePHP allows direct access of prefixed controller actions

    Affected
    >=2.0.0 <2.0.99 · >=2.1.0 <2.1.99 · >=2.2.0 <2.2.99 · >=2.3.0 <2.3.99 · >=2.4.0 <2.4.99 · >=2.5.0 <2.5.9 · >=2.6.0 <2.6.11 · >=2.7.0 <2.7.2
    Fixed in
    2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.9, 2.6.11, 2.7.2
  • HighGHSA-q79m-c546-2g6320 Jan 2023

    CakePHP vulnerable to Denial of Service attack through XML payloads

    Affected
    >=3.0.0 <3.0.6 · >=2.0.0 <2.0.99 · >=2.1.0 <2.1.99 · >=2.2.0 <2.2.99 · >=2.3.0 <2.3.99 · >=2.4.0 <2.4.99 · >=2.5.0 <2.5.90 · >=2.6.0 <2.6.6
    Fixed in
    2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.90, 2.6.6, 3.0.6
  • HighCVE-2016-4793GHSA-j8p3-8m69-2hqq14 May 2022

    CakePHP allows remote attackers to spoof their IP

    Affected
    >=1.2.0 <2.6.13 · >=2.7.0-rc1 <2.7.11 · >=2.8.0-rc1 <2.8.2 · >=3.0.0-rc1 <3.0.17 · >=3.1.0-beta1 <3.1.12 · >=3.2.0-rc1 <3.2.5
    Fixed in
    2.6.13, 2.7.11, 2.8.2, 3.0.17, 3.1.12, 3.2.5

Which of your client projects are still on cakephp/cakephp 2.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact cakephp/cakephp version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other cakephp/cakephp versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.