CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Summary

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Timeline

1. Sep 17, 2026, 2:49 PM UTCCVE published
2. Sep 17, 2026, 3:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 17, 2026, 3:20 PM UTCRecord last updated

Affected versions

• cakephp cakephp

  fixed in 4.5.12; From 4.6.0 · fixed in 4.6.5; From 5.0.0 · fixed in 5.1.9; From 5.2.0 · fixed in 5.2.14; From 5.3.0 · fixed in 5.3.7

• cakephp/databasePackagist

  From 3.0.0 · fixed in 4.5.12

• cakephp/databasePackagist

  From 4.6.0 · fixed in 4.6.5

• cakephp/databasePackagist

  From 5.0.0 · fixed in 5.1.9

• cakephp/databasePackagist

  From 5.2.0 · fixed in 5.2.14

• cakephp/databasePackagist

  From 5.3.0 · fixed in 5.3.7

• cakephp/cakephpPackagist

  fixed in 4.5.12

• cakephp/cakephpPackagist

  From 4.6.0 · fixed in 4.6.5

• cakephp/cakephpPackagist

  From 5.0.0 · fixed in 5.1.9

• cakephp/cakephpPackagist

  From 5.2.0 · fixed in 5.2.14

• cakephp/cakephpPackagist

  From 5.3.0 · fixed in 5.3.7

References 14