Vulnerability GHSA-fxf7-vhh8-7vpq
Critical
CRITICAL RISK
CVSS Score: 9.5
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
1 month ago
September 08, 2026 at 08:56 PM UTC
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6
Summary
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Details
Impact
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches
5.1.10, 5.2.15, 5.3.7
Workarounds
Don't provide user controlled data to these functions/parameters.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
3.0.0 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
3.0.0 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
3.0.0 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
3.0.0 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
High Risk
1 month ago
CakePHP: SmtpTransport vulnerable to CRLF header injection
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
Medium Risk
4 months ago
CakePHP: View::element() is missing a path containment check
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
Medium Risk
9 months ago
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
Impacted packages
Timeline
Published
1 month ago
September 08, 2026 at 08:56 PM UTC
Fixed (5.3.7)
3 months ago
July 09, 2026 at 03:06 AM UTC
Fixed (5.3.7)
3 months ago
July 14, 2026 at 03:04 AM UTC
Fixed (5.2.15)
3 months ago
July 16, 2026 at 03:58 AM UTC
Fixed (5.2.15)
3 months ago
July 16, 2026 at 04:03 AM UTC
Fixed (5.1.10)
3 months ago
July 16, 2026 at 04:19 AM UTC
Fixed (5.1.10)
3 months ago
July 16, 2026 at 04:20 AM UTC
Last Modified
1 month ago
September 08, 2026 at 09:15 PM UTC