{"id":"CVE-2026-77635","title":"CakePHP is a rapid development framework for PHP","summary":"CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data i…","severity":"critical","cwe":["CWE-89"],"vendor":"cakephp","product":"cakephp/cakephp","affected":["cakephp/cakephp >= 5.3.0, < 5.3.7","cakephp/cakephp >= 5.2.0, < 5.2.15","cakephp/cakephp >= 5.1.0, < 5.1.10","cakephp/database >= 5.3.0, < 5.3.7","cakephp/database >= 5.2.0, < 5.2.15","cakephp/database >= 5.1.0, < 5.1.10"],"patched":["cakephp/cakephp 5.3.7","cakephp/cakephp 5.2.15","cakephp/cakephp 5.1.10","cakephp/database 5.3.7","cakephp/database 5.2.15","cakephp/database 5.1.10"],"published":"2026-08-24","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:06:39.057","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77635","references":[{"url":"https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/releases/tag/5.1.10","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/releases/tag/5.2.15","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/releases/tag/5.3.7","label":"security-advisories@github.com"},{"url":"https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77635"},{"url":"https://github.com/advisories/GHSA-fxf7-vhh8-7vpq"}],"tags":["nvd","ghsa","composer","exploit-available"],"epss":0.00294,"epssPercentile":0.22182,"aliases":["GHSA-fxf7-vhh8-7vpq"],"ecosystem":"composer","ingestedAt":"2026-09-08T21:11:12.321Z","exploits":{"github":1,"githubRepos":["https://github.com/abraxas/CVE-2026-77635"],"checkedAt":"2026-09-21T15:30:42.865Z"},"exploitAvailable":true,"slug":"CVE-2026-77635","body":"## Overview\n\nCakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-77635)\n\nAffected packages:\n\n- `cakephp/cakephp >= 5.3.0, < 5.3.7`\n- `cakephp/cakephp >= 5.2.0, < 5.2.15`\n- `cakephp/cakephp >= 5.1.0, < 5.1.10`\n- `cakephp/database >= 5.3.0, < 5.3.7`\n- `cakephp/database >= 5.2.0, < 5.2.15`\n- `cakephp/database >= 5.1.0, < 5.1.10`\n\nPatched in:\n\n- `cakephp/cakephp 5.3.7`\n- `cakephp/cakephp 5.2.15`\n- `cakephp/cakephp 5.1.10`\n- `cakephp/database 5.3.7`\n- `cakephp/database 5.2.15`\n- `cakephp/database 5.1.10`\n\nSource: https://github.com/advisories/GHSA-fxf7-vhh8-7vpq","depth":"abyssal","depthScore":64,"depthScoreParts":{"impact":52.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208181,"id":"CVE-2026-77635","ts":1789926806964,"field":"exploit_available","old":"false","new":"true"}]}