CVE-2026-77635

CakePHP 5.2.13 — cakephp

CakePHP هو إطار تطوير سريع للغة PHP. قبل الإصدارات 5.1.10 و5.2.15 و5.3.7 على خطوط الإصدارات الخاصة بها، تُعد الدالة FunctionsBuilder::jsonValue() مع PostgresDriver عرضة لحقن SQL عندما يتم تمرير بيانات يتحكم بها المستخدم إلى المعامل jsonPath. تم إصلاح هذه المشكلة في الإصدارات 5.1.10 و5.2.15 و5.3.7.

# CVE-2026-77635 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635` - CWE: CWE-89 - published: 2026-08-24T21:17:48.457 ## NVD description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## Affected - cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3 - https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55 - https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f - https://github.com/cakephp/cakephp/releases/tag/5.1.10 - https://github.com/cakephp/cakephp/releases/tag/5.2.15 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json - https://nvd.nist.gov/vuln/detail/CVE-2026-77635 - https://github.com/advisories/GHSA-fxf7-vhh8-7vpq ## GitHub advisory CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver ### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. ### Patches 5.1.10, 5.2.15, 5.3.7 ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

CVE	CVE-2026-77635 · CVE.org
CWE	CWE-89
CVSS	حرج: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`
المنتج	CakePHP
المتأثر	5.2.x حتى 5.2.13 (أيضًا 5.1.x < 5.1.10، 5.3.x < 5.3.7)
المُرقَّع	5.2.15، 5.1.10، 5.3.7
المصادقة	لا شيء (انظر خريطة المصدر)
الترخيص	GNU Affero GPL v3.0
المختبر	`127.0.0.1` فقط · حزمة إفصاح للمورّد/العميل، وليست ماسحًا ضوئيًا

CVE-2026-77635

الأكثر شعبية

الإشعار (من خريطة المصدر)

المدخل

سلسلة الاستدعاء

الشروط المسبقة للمختبر

الشاهد

ليس نجاحًا

الترقيع / المعالجة

إعادة الإنتاج (مختبر مصرّح به)

صور المختبر

المراجع

السجلات (منظمة)

الترخيص

إخلاء المسؤولية