---
id: CVE-2026-79752
title: CakePHP is a rapid development framework for PHP
summary: >-
  CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5,
  5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract,
  FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in
  src/Database/FunctionsBui…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-89
vendor: cakephp
product: cakephp
affected:
  - cakephp < 4.5.12
  - 'cakephp >= 4.6.0, < 4.6.5'
  - 'cakephp >= 5.0.0, < 5.1.9'
  - 'cakephp >= 5.2.0, < 5.2.14'
  - 'cakephp >= 5.3.0, < 5.3.7'
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T16:17:44.693'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79752'
references:
  - url: >-
      https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d
    label: security-advisories@github.com
  - url: >-
      https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/pull/19520'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/pull/19528'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/4.5.12'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/4.6.5'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.1.9'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.2.14'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.3.7'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79752'
  - url: 'https://github.com/cakephp/cakephp/releases/tag/5.1.8'
  - url: 'https://github.com/advisories/GHSA-vjqc-q4mp-2rvf'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T15:19:49.116379Z'
cvssSource: cna
ingestedAt: '2026-09-17T15:20:38.998Z'
aliases:
  - GHSA-vjqc-q4mp-2rvf
ecosystem: composer
patched:
  - cakephp/database 4.5.12
  - cakephp/database 4.6.5
  - cakephp/database 5.1.9
  - cakephp/database 5.2.14
  - cakephp/database 5.3.7
  - cakephp/cakephp 4.5.12
  - cakephp/cakephp 4.6.5
  - cakephp/cakephp 5.1.9
  - cakephp/cakephp 5.2.14
  - cakephp/cakephp 5.3.7
epss: 0.00462
epssPercentile: 0.39295
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abraxas/CVE-2026-79752'
  checkedAt: '2026-09-23T07:14:52.635Z'
exploitAvailable: true
---

## Overview

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79752)

Affected packages:

- `cakephp/database < 4.5.12`
- `cakephp/database >= 4.6.0, < 4.6.5`
- `cakephp/database >= 5.0.0, < 5.1.9`
- `cakephp/database >= 5.2.0, < 5.2.14`
- `cakephp/database >= 5.3.0, < 5.3.7`
- `cakephp/cakephp < 4.5.12`
- `cakephp/cakephp >= 4.6.0, < 4.6.5`
- `cakephp/cakephp >= 5.0.0, < 5.1.9`
- `cakephp/cakephp >= 5.2.0, < 5.2.14`
- `cakephp/cakephp >= 5.3.0, < 5.3.7`

Patched in:

- `cakephp/database 4.5.12`
- `cakephp/database 4.6.5`
- `cakephp/database 5.1.9`
- `cakephp/database 5.2.14`
- `cakephp/database 5.3.7`
- `cakephp/cakephp 4.5.12`
- `cakephp/cakephp 4.6.5`
- `cakephp/cakephp 5.1.9`
- `cakephp/cakephp 5.2.14`
- `cakephp/cakephp 5.3.7`

Source: https://github.com/advisories/GHSA-vjqc-q4mp-2rvf