abraxas/cve-2026-77635Disclosure pack and Python PoC for CVE-2026-77635, an unauthenticated SQL injection in CakePHP's jsonValue() with PostgresDriver, including a loopback Docker lab.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-77635
CakePHP 5.2.13 — cakephp
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
| CVE | CVE-2026-77635 · CVE.org |
| CWE | CWE-89 |
| CVSS | Critical: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| Product | CakePHP |
| Affected | 5.2.x through 5.2.13 (also 5.1.x < 5.1.10, 5.3.x < 5.3.7) |
| Patched | 5.2.15, 5.1.10, 5.3.7 |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
jsonValue $jsonPath is the sink. HTTP is GET /?path= on the lab app.
GET/?path=GET /?path=<injected jsonPath>PostgresDriver quoteIdentifier into JSONB_PATH_QUERYSELECT leaks notes.secretPOCWitness77635 in HTTP body and sql= contains the injected fragment.
Do this first: Update CakePHP to 5.2.15 (or 5.1.10 / 5.3.7). Advisory: GHSA-fxf7-vhh8-7vpq.
Verify after upgrade
CVE-2026-77635-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-77635-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq
github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-77635 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635`
- CWE: CWE-89
- published: 2026-08-24T21:17:48.457
## NVD description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
## MITRE description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
## Affected
- cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected
- cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected
- OSV:
## References (JSON sources only)
- https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
- https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
- https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
- https://github.com/cakephp/cakephp/releases/tag/5.1.10
- https://github.com/cakephp/cakephp/releases/tag/5.2.15
- https://github.com/cakephp/cakephp/releases/tag/5.3.7
- https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-77635
- https://github.com/advisories/GHSA-fxf7-vhh8-7vpq
## GitHub advisory
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
### Impact
The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.
### Patches
5.1.10, 5.2.15, 5.3.7
### Workarounds
Don't provide user controlled data to these functions/parameters.
## OSV
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.