---
id: CVE-2026-77635
title: CakePHP is a rapid development framework for PHP
summary: >-
  CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10,
  5.2.15, and 5.3.7 on their respective release lines,
  FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL
  injection when user-controlled data i…
severity: critical
cwe:
  - CWE-89
vendor: cakephp
product: cakephp/cakephp
affected:
  - 'cakephp/cakephp >= 5.3.0, < 5.3.7'
  - 'cakephp/cakephp >= 5.2.0, < 5.2.15'
  - 'cakephp/cakephp >= 5.1.0, < 5.1.10'
  - 'cakephp/database >= 5.3.0, < 5.3.7'
  - 'cakephp/database >= 5.2.0, < 5.2.15'
  - 'cakephp/database >= 5.1.0, < 5.1.10'
patched:
  - cakephp/cakephp 5.3.7
  - cakephp/cakephp 5.2.15
  - cakephp/cakephp 5.1.10
  - cakephp/database 5.3.7
  - cakephp/database 5.2.15
  - cakephp/database 5.1.10
published: '2026-08-24'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:06:39.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77635'
references:
  - url: >-
      https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.1.10'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.2.15'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.3.7'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77635'
  - url: 'https://github.com/advisories/GHSA-fxf7-vhh8-7vpq'
tags:
  - nvd
  - ghsa
  - composer
  - exploit-available
epss: 0.00294
epssPercentile: 0.22234
aliases:
  - GHSA-fxf7-vhh8-7vpq
ecosystem: composer
ingestedAt: '2026-09-08T21:11:12.321Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abraxas/CVE-2026-77635'
  checkedAt: '2026-09-24T07:53:17.633Z'
exploitAvailable: true
---

## Overview

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-77635)

Affected packages:

- `cakephp/cakephp >= 5.3.0, < 5.3.7`
- `cakephp/cakephp >= 5.2.0, < 5.2.15`
- `cakephp/cakephp >= 5.1.0, < 5.1.10`
- `cakephp/database >= 5.3.0, < 5.3.7`
- `cakephp/database >= 5.2.0, < 5.2.15`
- `cakephp/database >= 5.1.0, < 5.1.10`

Patched in:

- `cakephp/cakephp 5.3.7`
- `cakephp/cakephp 5.2.15`
- `cakephp/cakephp 5.1.10`
- `cakephp/database 5.3.7`
- `cakephp/database 5.2.15`
- `cakephp/database 5.1.10`

Source: https://github.com/advisories/GHSA-fxf7-vhh8-7vpq