CVE-2026-77635

CakePHP 5.2.13 — cakephp

CakePHP, PHP के लिए एक तेज़ विकास फ्रेमवर्क है। अपनी-अपनी रिलीज़ लाइनों पर संस्करण 5.1.10, 5.2.15 और 5.3.7 से पहले, PostgresDriver के साथ FunctionsBuilder::jsonValue() तब SQL इंजेक्शन के प्रति असुरक्षित है जब jsonPath पैरामीटर में उपयोगकर्ता-नियंत्रित डेटा दिया जाता है। यह समस्या संस्करण 5.1.10, 5.2.15 और 5.3.7 में ठीक कर दी गई है।

# CVE-2026-77635 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635` - CWE: CWE-89 - published: 2026-08-24T21:17:48.457 ## NVD description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## Affected - cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3 - https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55 - https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f - https://github.com/cakephp/cakephp/releases/tag/5.1.10 - https://github.com/cakephp/cakephp/releases/tag/5.2.15 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json - https://nvd.nist.gov/vuln/detail/CVE-2026-77635 - https://github.com/advisories/GHSA-fxf7-vhh8-7vpq ## GitHub advisory CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver ### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. ### Patches 5.1.10, 5.2.15, 5.3.7 ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

CVE	CVE-2026-77635 · CVE.org
CWE	CWE-89
CVSS	Critical: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`
Product	CakePHP
Affected	5.2.x 5.2.13 तक (साथ ही 5.1.x < 5.1.10, 5.3.x < 5.3.7)
Patched	5.2.15, 5.1.10, 5.3.7
Auth	कोई नहीं (स्रोत मैप देखें)
License	GNU Affero GPL v3.0
Lab	केवल `127.0.0.1` · विक्रेता/क्लाइंट डिस्क्लोज़र पैक, स्कैनर नहीं

CVE-2026-77635

सबसे लोकप्रिय

सलाह (स्रोत मैप से)

प्रवेश

कॉल चेन

लैब पूर्वापेक्षाएँ

Witness

सफलता नहीं

पैच / उपचार

पुनरुत्पादन (अधिकृत लैब)

लैब इमेज

संदर्भ

रिकॉर्ड (संरचित)

लाइसेंस

अस्वीकरण