CVE-2026-119418 json
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
published 2026-10-30 10 d ago modified 2026-10-30 9 d ago also EUVD-2026-113798
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
Patch / fix
- cakephp cakephp 5.4.4
- cakefoundation cakephp 5.4.4
- github.com/cakephp/cakephp@18de3e4 commit
- github.com/cakephp/cakephp@a5ca174 commit
- github.com/cakephp/cakephp@3c1183f commit
- github.com/cakephp/cakephp#19735 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 d ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- cakephp cakephp
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
patch
-
github.com
/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
patch
-
github.com
/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
patch
-
github.com
/cakephp/cakephp/pull/19735
patch, issue-tracking
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L1
technical-description
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L3
technical-description
-
abraxaslabs.tech
/research/cakephp-window-sqli
third-party-advisory
-
github.com
/cakephp/cakephp
product
-
vulncheck.com
/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
third-party-advisory
Sources
- CVE List CVE-2026-119418
- NVD CVE-2026-119418
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.