SQL Injection in Cakephp
CVE-2026-119418
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565 (patch)
- github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9 (patch)
- github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f (patch)
- github.com/cakephp/cakephp/pull/19735 (issue-tracking, patch)
- github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Da… (technical-description)
- github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Da… (technical-description)
- abraxaslabs.tech/research/cakephp-window-sqli (third-party-advisory)
- github.com/cakephp/cakephp (product)
- www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpr… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-119418?
- CVE-2026-119418 is a high-severity vulnerability in Cakephp, classified under SQL Injection. CVSS score: 8.1/10. Published 2026-10-30.
- How severe is CVE-2026-119418?
- High severity. CVSS v3 base score is 8.1 out of 10.