CriticalGHSA-6g8q-qfpv-57wpCVE-2023-22727

CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection

Published 20 Jan 2023 · Updated 10 Sept 2026

Affected packages

cakephp/cakephpComposer
Affected
>=4.2.0 <4.2.12
Fixed in
4.2.12
Update to the fixed version for your release line, for example:composer require cakephp/cakephp:^4.2.12
cakephp/cakephpComposer
Affected
>=4.3.0 <4.3.11
Fixed in
4.3.11
Update to the fixed version for your release line, for example:composer require cakephp/cakephp:^4.3.11
cakephp/cakephpComposer
Affected
>=4.4.0 <4.4.10
Fixed in
4.4.10
Update to the fixed version for your release line, for example:composer require cakephp/cakephp:^4.4.10
cakephp/databaseComposer
Affected
>=4.2.0 <4.2.12
Fixed in
4.2.12
Update to the fixed version for your release line, for example:composer require cakephp/database:^4.2.12
cakephp/databaseComposer
Affected
>=4.3.0 <4.3.11
Fixed in
4.3.11
Update to the fixed version for your release line, for example:composer require cakephp/database:^4.3.11
cakephp/databaseComposer
Affected
>=4.4.0 <4.4.10
Fixed in
4.4.10
Update to the fixed version for your release line, for example:composer require cakephp/database:^4.4.10

Details

Impact

The Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data.

Patches

This issue has been fixed in 4.2.12, 4.3.11, 4.4.10

Workarounds

Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods.

References

https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html

Is GHSA-6g8q-qfpv-57wp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected cakephp/cakephp, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.