CVE-2026-119418 in CakePHP
Summary
by MITRE • 10/30/2026
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the CakePHP framework, specifically affecting versions up to 5.4.3, where a critical SQL injection vulnerability is present in the WindowExpression class. This component is responsible for handling window functions and frame specifications in SQL queries, which are commonly used for complex analytical operations such as ranking or running totals. The root cause of this vulnerability lies in the insufficient validation of user-supplied input when defining the range and direction parameters for these window frames. Specifically, the methods WindowExpression::range() and WindowExpression::frame() accept offsets and directions that determine how rows are grouped within a partition but fail to adequately sanitize or validate these inputs before they are incorporated into the final SQL statement.
This lack of validation allows an attacker who can influence the input passed to these functions to inject arbitrary SQL code directly into the OVER clause of a query. By crafting specific values for frame offsets and directions, an adversary can break out of the intended syntax structure and append malicious commands that will be executed by the database engine using the privileges associated with the application's database connection account. This capability transforms what should be a benign configuration parameter into a powerful vector for unauthorized data access or manipulation, bypassing standard query construction safeguards provided by the framework's ORM layer.
The operational impact of this vulnerability is severe due to its potential for full database compromise. An attacker can exploit this flaw to read sensitive information from other tables that are not part of the original query result set, potentially exposing user credentials, personal identifiable information, or proprietary business data. Furthermore, depending on the capabilities granted to the database user account running the application, the injected SQL could be used to modify existing records, delete critical data, or even execute operating system commands if the database server permits such extensions like xp_cmdshell in Microsoft SQL Server or similar features in other RDBMS platforms. This represents a significant risk to data integrity and confidentiality within any web application relying on CakePHP for its backend logic.
From a classification perspective, this vulnerability aligns with CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector leverages the injection point located within the OVER clause syntax, exploiting the parser's interpretation of frame specifications to execute unintended commands. In terms of tactical mapping under the MITRE ATT&CK framework, this exploitation technique falls under T1059, specifically command and script interpreter execution via database interfaces, as it allows an attacker to leverage the database engine itself to perform actions beyond simple data retrieval.
To mitigate this risk, organizations using CakePHP must immediately upgrade their frameworks to version 5.4.3 or later where these validation checks have been implemented by the development team. For applications that cannot be updated instantly due to compatibility constraints, a temporary workaround involves implementing strict input validation on any parameters passed to WindowExpression methods before they are processed. This includes ensuring that frame offsets and directions conform strictly to expected numeric formats and allowed directional values such as PRECEDING or FOLLOWING without allowing arbitrary string injection. Additionally, employing parameterized queries wherever possible and adhering to the principle of least privilege for database accounts can further reduce the blast radius should an exploitation attempt occur. Regular security audits and static code analysis tools configured to detect SQL injection patterns in dynamic query construction are also recommended to identify similar weaknesses across the application codebase.