CVE-2026-79752: CakePHP FunctionsBuilder SQL injection in multiple methods

CVE-2026-79752 · Severity: critical · CVSS 4 · Published 2026-09-17

CakePHP is a popular web application framework used to build PHP-based websites and applications. Multiple query-building methods in the framework fail to properly sanitize user-supplied parameters, allowing an attacker to inject malicious SQL commands. If an application uses these methods with untrusted input, an attacker could read, modify, or delete sensitive database records.

Technologies: Cakephp, cakephp/cakephp (Packagist), cakephp/database (Packagist). Vendors: Cakephp, Packagist.

Quick answers

Is CVE-2026-79752 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79752 being exploited in the wild.
How severe is CVE-2026-79752?
Critical severity, with a CVSS score of 4, published 17 September 2026.
Which products and versions are affected?
Cakephp < 4.5.12, >= 4.6.0 and < 4.6.5, >= 5.0.0 and < 5.1.9, >= 5.2.0 and < 5.2.14, >= 5.3.0 and < 5.3.7; cakephp/cakephp (Packagist) ECOSYSTEM:introduced=0,fixed=4.5.12; cakephp/database (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=4.5.12.
Is there a fix for CVE-2026-79752?
Yes. cakephp/cakephp (Packagist): upgrade to 4.5.12 or later; cakephp/database (Packagist): upgrade to 4.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79752 attacked?
It is attacked over the network.
Am I affected by CVE-2026-79752?
Check whether you run Cakephp, cakephp/cakephp (Packagist) or cakephp/database (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cakephp/cakephp (Packagist): upgrade to 4.5.12 or later
    composer require cakephp/cakephp:^4.5.12
  • cakephp/database (Packagist): upgrade to 4.5.12 or later
    composer require cakephp/database:^4.5.12

Technical details

The FunctionsBuilder class in CakePHP contains SQL injection vulnerabilities in the cast(), extract(), datePart(), and dateAdd() methods when user-controlled data is passed to the $dataType, $part, or $unit parameters. The root cause is insufficient input validation or parameterization of these parameters before they are incorporated into SQL queries. An attacker with network access to an application using these methods with untrusted input can inject arbitrary SQL through these parameters without requiring prior authentication. Successful exploitation allows reading, modifying, or deleting database records and potentially executing operating system commands depending on database privileges. Patches are available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Affected products

  • CakePHP CakePHP < 4.5.12, >= 4.6.0 and < 4.6.5, >= 5.0.0 and < 5.1.9, >= 5.2.0 and < 5.2.14, >= 5.3.0 and < 5.3.7
  • CakePHP Database >= 3.0.0 and < 4.5.12, >= 4.6.0 and < 4.6.5, >= 5.0.0 and < 5.1.9, >= 5.2.0 and < 5.2.14, >= 5.3.0 and < 5.3.7

Identifiers

  • CVE-2026-79752
  • GHSA-vjqc-q4mp-2rvf

Timeline

  • 2026-09-17: disclosed: Published to GitHub Advisory Database
  • 2026-09-17: patched: Fixes available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.