CVE-2026-77635 in CakePHP
Summary
by MITRE • 08/24/2026
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified within CakePHP frameworks prior to version 5.1.10 on the 5.1.x line, version 5.2.15 on the 5.2.x line, and version 5.3.7 on the 5.3.x line represents a critical security flaw in the database interaction layer when utilizing the PostgresDriver. Specifically, the FunctionsBuilder::jsonValue() method is susceptible to SQL injection attacks if an attacker can supply controlled data through the jsonPath parameter. This function is designed to facilitate complex JSON operations within PostgreSQL databases by allowing developers to construct queries that extract or manipulate JSONB data types efficiently. However, in these affected versions, the framework fails to adequately sanitize or properly bind user-supplied input intended for the jsonPath argument before incorporating it into the underlying SQL query structure.
The technical root cause of this vulnerability lies in improper handling of dynamic string construction within the database driver layer. When a developer passes untrusted data directly to the jsonPath parameter, that data is interpolated into the SQL statement without sufficient validation or escaping mechanisms specific to PostgreSQL syntax for JSON path expressions. This allows an attacker to inject malicious SQL code fragments that alter the logic of the query. By manipulating the jsonPath input, an adversary can potentially bypass intended access controls, extract sensitive information from other tables via UNION-based injection techniques, or even execute administrative commands depending on the privileges assigned to the database user account used by the application. This flaw aligns with CWE-89, which categorizes SQL Injection as a failure to neutralize special elements within input that could be interpreted by a command interpreter, in this case, the PostgreSQL query engine.
The operational impact of exploiting this vulnerability is severe and multifaceted. Successful exploitation can lead to unauthorized data disclosure, where an attacker retrieves confidential user information, financial records, or proprietary business logic stored within JSON columns. Furthermore, depending on the database configuration and permissions, a skilled attacker might escalate privileges to perform destructive actions such as modifying or deleting critical application data, thereby compromising data integrity and availability. The vulnerability also poses risks related to authentication bypass if the injected SQL manipulates query conditions used for user verification processes. This type of attack is commonly associated with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques that leverage database commands, as well as data exfiltration methods described under TA0009 Collection.
To mitigate this risk, organizations running affected versions of CakePHP must immediately upgrade to the patched releases: 5.1.10 for the 5.1.x branch, 5.2.15 for the 5.2.x branch, and 5.3.7 for the 5.3.x branch. These updates contain code changes that enforce strict parameter binding or proper escaping of inputs passed to jsonPath functions within the PostgresDriver context. In addition to upgrading, developers should review existing applications using these frameworks to identify any instances where FunctionsBuilder::jsonValue() is called with user-controlled data and ensure that such calls are updated to use safe coding practices even after patching. Implementing input validation at the application layer as a defense-in-depth measure can further reduce exposure by rejecting malformed or unexpected inputs before they reach the database driver. Regular security audits and static code analysis tools configured to detect SQL injection patterns should be employed to maintain long-term resilience against similar vulnerabilities in future development cycles.