CVE-2026-119419 in CakePHP
Summary
by MITRE • 10/30/2026
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in CakePHP versions through 5.4.3 represents a critical security flaw rooted in improper input validation and sanitization mechanisms within the framework's query builder components. Specifically, this issue affects the StringExpression and IdentifierExpression classes, which are fundamental to constructing database queries dynamically. When developers utilize these expressions to handle collation settings for string comparisons or identifier definitions, the application fails to adequately validate the provided collation names before embedding them into SQL statements. This lack of rigorous validation allows an attacker who can control the input passed to the constructor or the setCollation method to inject arbitrary SQL code directly after the unquoted COLLATE clause in the generated query structure.
From a technical perspective, the core flaw lies in the absence of strict allow-listing for collation identifiers. Database systems typically require that certain metadata elements like table names, column names, and collations be properly quoted or escaped to prevent them from being interpreted as executable SQL syntax. In this instance, because the collation value is inserted without sufficient quoting or escaping safeguards, any special characters or SQL keywords introduced by an attacker are executed directly by the database engine. This bypasses standard parameterized query protections that might otherwise mitigate injection risks in other parts of the application logic, highlighting a specific weakness in how CakePHP handles metadata identifiers compared to data values.
The operational impact of this vulnerability is severe due to its potential for full database compromise. Since SQL injection attacks allow attackers to manipulate the structure and execution flow of database queries, an adversary could exploit this flaw to read sensitive data from tables they should not access, modify or delete records, or even execute administrative operations depending on the privileges assigned to the database user account used by the application. The vulnerability affects every database driver within the connection's context, meaning that regardless whether the backend is MySQL, PostgreSQL, SQLite, or another supported engine, the injection vector remains viable as long as the framework processes unvalidated collation inputs in this manner. This broad compatibility impact increases the risk surface significantly for applications relying on CakePHP across diverse deployment environments.
This vulnerability aligns with CWE-89, which classifies Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector corresponds to ATT&CK technique T1059, specifically sub-techniques related to command scripting or database query manipulation, where the attacker leverages application logic flaws to execute unauthorized commands within the backend system. Remediation efforts must prioritize upgrading CakePHP to version 5.4.3 or later, which addresses this specific input validation gap. For applications that cannot immediately upgrade, developers should implement strict allow-listing for collation names at the application layer before passing them to StringExpression or IdentifierExpression instances. Additionally, employing database-specific escaping functions and reviewing all dynamic query constructions involving metadata identifiers can provide additional layers of defense against similar injection attempts in legacy codebases.