CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
Affects CakePHP through 5.4.3 when user-controlled data is passed to the collation parameter of IdentifierExpression or StringExpression objects. CVSS rates it 9.2 (critical), and no fix is listed in the checked facts.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- cakephp cakephp
through 5.4.3
References 10
GitHub · cakephp/cakephp
abraxaslabs.tech
Questions about CVE-2026-119419
What does this mean?
Data that comes from user input can be placed into the collation parameter of low-level CakePHP expression objects. The advisory states this can lead to SQL injection through that parameter.Source: github.com
Am I affected, and how do I check?
The product range listed runs from the start through CakePHP 5.4.3. The issue applies only where user-controlled data reaches the collation parameter of an IdentifierExpression or StringExpression. A reader can check the installed version in composer.lock or with the CakePHP version shown in the vendor/cakephp/cakephp package, then search the code for where collation values come from.Source: github.com
What should I do about it?
The checked facts name no fixed version, so no upgrade target can be given from them. Until the advisory names a fix, avoid passing user-controlled values to the collation parameter of these expression objects.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data