CriticalGHSA-vjqc-q4mp-2rvfCVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Published 17 Sept 2026 · Updated 24 Sept 2026
Affected packages
cakephp/databaseComposer
- Affected
- >=3.0.0 <4.5.12
- Fixed in
- 4.5.12
Update to the fixed version for your release line, for example:
composer require cakephp/database:^4.5.12cakephp/databaseComposer
- Affected
- >=4.6.0 <4.6.5
- Fixed in
- 4.6.5
Update to the fixed version for your release line, for example:
composer require cakephp/database:^4.6.5cakephp/databaseComposer
- Affected
- >=5.0.0 <5.1.9
- Fixed in
- 5.1.9
Update to the fixed version for your release line, for example:
composer require cakephp/database:^5.1.9cakephp/databaseComposer
- Affected
- >=5.2.0 <5.2.14
- Fixed in
- 5.2.14
Update to the fixed version for your release line, for example:
composer require cakephp/database:^5.2.14cakephp/databaseComposer
- Affected
- >=5.3.0 <5.3.7
- Fixed in
- 5.3.7
Update to the fixed version for your release line, for example:
composer require cakephp/database:^5.3.7cakephp/cakephpComposer
- Affected
- <4.5.12
- Fixed in
- 4.5.12
Update to the fixed version for your release line, for example:
composer require cakephp/cakephp:^4.5.12cakephp/cakephpComposer
- Affected
- >=4.6.0 <4.6.5
- Fixed in
- 4.6.5
Update to the fixed version for your release line, for example:
composer require cakephp/cakephp:^4.6.5cakephp/cakephpComposer
- Affected
- >=5.0.0 <5.1.9
- Fixed in
- 5.1.9
Update to the fixed version for your release line, for example:
composer require cakephp/cakephp:^5.1.9cakephp/cakephpComposer
- Affected
- >=5.2.0 <5.2.14
- Fixed in
- 5.2.14
Update to the fixed version for your release line, for example:
composer require cakephp/cakephp:^5.2.14cakephp/cakephpComposer
- Affected
- >=5.3.0 <5.3.7
- Fixed in
- 5.3.7
Update to the fixed version for your release line, for example:
composer require cakephp/cakephp:^5.3.7Details
Impact
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds
Don't provide user controlled data to these functions/parameters.
Is GHSA-vjqc-q4mp-2rvf in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected cakephp/database, and gives you the command that fixes it.
References
- Linkgithub.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-79752
- Linkgithub.com/cakephp/cakephp/pull/19528
- Linkgithub.com/cakephp/cakephp/pull/19520
- Linkgithub.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
- Linkgithub.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
- Linkgithub.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
- Linkgithub.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71
- Linkgithub.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
- Linkgithub.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
- Linkgithub.com/cakephp/cakephp/releases/tag/4.5.12
- Linkgithub.com/cakephp/cakephp/releases/tag/4.6.5
- Linkgithub.com/cakephp/cakephp/releases/tag/5.1.8
- Linkgithub.com/cakephp/cakephp/releases/tag/5.1.9
- Linkgithub.com/cakephp/cakephp/releases/tag/5.2.14
- Linkgithub.com/cakephp/cakephp/releases/tag/5.3.7
- Packagegithub.com/cakephp/cakephp
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.