CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue SQL injection with PostgresDriver

CVE-2026-77635 · Severity: critical · CVSS 4 · Published 2026-08-24

CakePHP's FunctionsBuilder::jsonValue() method, used to build database queries for JSON field access in PostgreSQL, contains a SQL injection vulnerability when untrusted user input is passed to the jsonPath parameter. An attacker who can supply malicious input to this parameter can execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive database records or data modification.

Technologies: Cakephp, cakephp/cakephp (Packagist), cakephp/database (Packagist). Vendors: Cakephp, Packagist.

Quick answers

Is CVE-2026-77635 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77635 being exploited in the wild.
How severe is CVE-2026-77635?
Critical severity, with a CVSS score of 4, published 24 August 2026.
Which products and versions are affected?
Cakephp >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7; cakephp/cakephp (Packagist) ECOSYSTEM:introduced=5.3.0,fixed=5.3.7; cakephp/database (Packagist) ECOSYSTEM:introduced=5.3.0,fixed=5.3.7.
Is there a fix for CVE-2026-77635?
Yes. cakephp/cakephp (Packagist): upgrade to 5.3.7 or later; cakephp/database (Packagist): upgrade to 5.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77635 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77635?
Check whether you run Cakephp, cakephp/cakephp (Packagist) or cakephp/database (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cakephp/cakephp (Packagist): upgrade to 5.3.7 or later
    composer require cakephp/cakephp:^5.3.7
  • cakephp/database (Packagist): upgrade to 5.3.7 or later
    composer require cakephp/database:^5.3.7

Technical details

The vulnerability exists in the FunctionsBuilder::jsonValue() method used by CakePHP's ORM when interacting with PostgreSQL databases. The method transforms JSON query operations but fails to properly sanitize the jsonPath parameter before incorporating it into the generated SQL query. When user-controlled data is passed to the jsonPath parameter, an attacker can break out of the intended query context and inject arbitrary SQL commands. The postgres driver performs specific transformations to rename the function and apply cast operations, but the implementation does not adequately escape or parameterize the path expression. No authentication is required to exploit this vulnerability if the application exposes the affected function to user input. Patches are available in versions 5.1.10, 5.2.15, and 5.3.7, which implement proper input validation and escaping for the jsonPath parameter.

Affected products

  • CakePHP cakephp >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7
  • CakePHP cakephp/database >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7

Identifiers

  • CVE-2026-77635
  • GHSA-fxf7-vhh8-7vpq

Timeline

  • 2026-08-21: disclosed: Vulnerability published by CakePHP
  • 2026-08-21: patched: Patches released: 5.1.10, 5.2.15, 5.3.7
  • 2026-09-08: advisory: GitHub Advisory Database entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.