CVE-2026-79752: CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters.
Recommended action
Recommended action
Upgrade affected packages to a patched version: cakephp/database 4.5.12, cakephp/database 4.6.5, cakephp/database 5.1.9, cakephp/database 5.2.14, cakephp/database 5.3.7, cakephp/cakephp 4.5.12, cakephp/cakephp 4.6.5, cakephp/cakephp 5.1.9, cakephp/cakephp 5.2.14, cakephp/cakephp 5.3.7.
Technical details
- Vendor
- Not specified
- Product
- cakephp/database, cakephp/cakephp
- Exploitation
- none known
- Evidence
- official
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source