---
id: CVE-2026-48820
title: 'CakePHP: View::element() is missing a path containment check'
summary: 'CakePHP: View::element() is missing a path containment check'
severity: medium
cwe:
  - CWE-22
vendor: cakephp
product: cakephp/cakephp
ecosystem: composer
affected:
  - 'cakephp/cakephp >= 5.3.0, < 5.3.6'
  - 'cakephp/cakephp >= 5.2.0, < 5.2.13'
  - 'cakephp/cakephp >= 5.0.0, < 5.1.7'
  - 'cakephp/cakephp >= 4.6.0, < 4.6.4'
  - cakephp/cakephp < 4.5.11
patched:
  - cakephp/cakephp 5.3.6
  - cakephp/cakephp 5.2.13
  - cakephp/cakephp 5.1.7
  - cakephp/cakephp 4.6.4
  - cakephp/cakephp 4.5.11
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wpvj-hjcr-h3p2'
references:
  - url: 'https://github.com/cakephp/cakephp/security/advisories/GHSA-wpvj-hjcr-h3p2'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48820'
  - url: 'https://github.com/advisories/GHSA-wpvj-hjcr-h3p2'
tags:
  - ghsa
  - composer
epss: 0.00258
epssPercentile: 0.17759
ingestedAt: '2026-06-29T13:24:35.252Z'
---

## Overview

### Impact
`View::_getElementFileName()` does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

### Patches
Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

### Workarounds
If developers are not using user-supplied data in element names, no action is required.

## Affected packages

- `cakephp/cakephp >= 5.3.0, < 5.3.6`
- `cakephp/cakephp >= 5.2.0, < 5.2.13`
- `cakephp/cakephp >= 5.0.0, < 5.1.7`
- `cakephp/cakephp >= 4.6.0, < 4.6.4`
- `cakephp/cakephp < 4.5.11`

## Remediation

Upgrade to a patched release:

- `cakephp/cakephp 5.3.6`
- `cakephp/cakephp 5.2.13`
- `cakephp/cakephp 5.1.7`
- `cakephp/cakephp 4.6.4`
- `cakephp/cakephp 4.5.11`