Junglewise Threat Intelligence

CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue SQL injection with PostgresDriver

CVE-2026-77635 · Severity: critical · CVSS 9.2 · Published 2026-09-08

Executive brief

CakePHP's FunctionsBuilder::jsonValue() method, used to build database queries for JSON field access in PostgreSQL, contains a SQL injection vulnerability when untrusted user input is passed to the jsonPath parameter. An attacker who can supply malicious input to this parameter can execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive database records or data modification.

Technical details

The vulnerability exists in the FunctionsBuilder::jsonValue() method used by CakePHP's ORM when interacting with PostgreSQL databases. The method transforms JSON query operations but fails to properly sanitize the jsonPath parameter before incorporating it into the generated SQL query. When user-controlled data is passed to the jsonPath parameter, an attacker can break out of the intended query context and inject arbitrary SQL commands. The postgres driver performs specific transformations to rename the function and apply cast operations, but the implementation does not adequately escape or parameterize the path expression. No authentication is required to exploit this vulnerability if the application exposes the affected function to user input. Patches are available in versions 5.1.10, 5.2.15, and 5.3.7, which implement proper input validation and escaping for the jsonPath parameter.

Affected products

  • CakePHP cakephp >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7
  • CakePHP cakephp/database >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7

Timeline

  • 2026-08-21: disclosed: Vulnerability published by CakePHP
  • 2026-08-21: patched: Patches released: 5.1.10, 5.2.15, 5.3.7
  • 2026-09-08: advisory: GitHub Advisory Database entry published

References

Related threats