CVE-2026-77635
Fixed upstream EPSS <1%CVSS 9.2
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Products: cakephp, cakephp/database
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | cakephp/cakephp | 5.3.7 |
| Packagist | cakephp/cakephp | 5.2.15 |
| Packagist | cakephp/cakephp | 5.1.10 |
| Packagist | cakephp/database | 5.3.7 |
| Packagist | cakephp/database | 5.2.15 |
| Packagist | cakephp/database | 5.1.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | cakephp | no fix |
| Ubuntu 16.04 LTS | cakephp | no fix |
| Ubuntu 20.04 LTS | cakephp | no fix |
| Ubuntu 22.04 LTS | cakephp | no fix |