CVE-2026-77635

CakePHP 5.2.13 — cakephp

CakePHP — это фреймворк для быстрой разработки на PHP. В версиях до 5.1.10, 5.2.15 и 5.3.7 на соответствующих линиях релизов метод FunctionsBuilder::jsonValue() с PostgresDriver уязвим к SQL-инъекции, когда в параметр jsonPath передаются контролируемые пользователем данные. Эта проблема исправлена в версиях 5.1.10, 5.2.15 и 5.3.7.

# CVE-2026-77635 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635` - CWE: CWE-89 - published: 2026-08-24T21:17:48.457 ## NVD description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## Affected - cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3 - https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55 - https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f - https://github.com/cakephp/cakephp/releases/tag/5.1.10 - https://github.com/cakephp/cakephp/releases/tag/5.2.15 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json - https://nvd.nist.gov/vuln/detail/CVE-2026-77635 - https://github.com/advisories/GHSA-fxf7-vhh8-7vpq ## GitHub advisory CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver ### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. ### Patches 5.1.10, 5.2.15, 5.3.7 ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

CVE	CVE-2026-77635 · CVE.org
CWE	CWE-89
CVSS	Critical: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`
Продукт	CakePHP
Затронуто	5.2.x до 5.2.13 включительно (также 5.1.x < 5.1.10, 5.3.x < 5.3.7)
Исправлено	5.2.15, 5.1.10, 5.3.7
Аутентификация	отсутствует (см. карту исходников)
Лицензия	GNU Affero GPL v3.0
Лаборатория	только `127.0.0.1` · пакет для раскрытия вендору/клиенту, не сканер

CVE-2026-77635

Популярное

Рекомендации (из карты исходников)

Точка входа

Цепочка вызовов

Предусловия лаборатории

Свидетель

Не является успехом

Патч / устранение

Воспроизведение (авторизованная лаборатория)

Образы лаборатории

Ссылки

Записи (структурированные)

Лицензия

Отказ от ответственности