Vulnerability GHSA-wpvj-hjcr-h3p2
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 26, 2026 at 09:00 PM UTC
CakePHP: View::element() is missing a path containment check
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5
Summary
CakePHP: View::element() is missing a path containment check
Details
Impact
View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.
Patches
Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Workarounds
If developers are not using user-supplied data in element names, no action is required.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
Critical
1 month ago
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
High Risk
1 month ago
CakePHP: SmtpTransport vulnerable to CRLF header injection
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
Medium Risk
9 months ago
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
Medium Risk
3 years ago
CakePHP vulnerable to Cross-site Scripting in some development error pages
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 09:00 PM UTC
Fixed (5.2.13)
5 months ago
May 23, 2026 at 04:33 PM UTC
Fixed (5.1.7)
5 months ago
May 23, 2026 at 04:51 PM UTC
Fixed (4.6.4)
5 months ago
May 23, 2026 at 04:54 PM UTC
Fixed (5.3.6)
5 months ago
May 23, 2026 at 04:55 PM UTC
Fixed (4.5.11)
5 months ago
May 23, 2026 at 04:57 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC