CVE-2026-79752

CakePHP 5.2.13 — cakephp

CakePHP — это фреймворк для быстрой разработки на PHP. До версий 4.5.12, 4.6.5, 5.1.9, 5.2.14 и 5.3.7 методы FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart и FunctionsBuilder::dateAdd в файле src/Database/FunctionsBuilder.php принимают контролируемые пользователем значения dataType, part или unit и включают их в генерируемый SQL как неэкранированные структурные фрагменты. Приложение, передающее недоверенный ввод в эти параметры, может допустить SQL-инъекцию с влиянием на конфиденциальность, целостность и доступность в соответствии с привилегиями подключения к базе данных. Эта проблема исправлена в версиях 4.5.12, 4.6.5, 5.1.9, 5.2.14 и 5.3.7.

# CVE-2026-79752 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752` - CWE: CWE-89 - published: 2026-09-17T15:16:51.673 ## NVD description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## Affected - cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0 - https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e - https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676 - https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d - https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45 - https://github.com/cakephp/cakephp/pull/19520 - https://github.com/cakephp/cakephp/pull/19528 - https://github.com/cakephp/cakephp/releases/tag/4.5.12 - https://github.com/cakephp/cakephp/releases/tag/4.6.5 - https://github.com/cakephp/cakephp/releases/tag/5.1.9 - https://github.com/cakephp/cakephp/releases/tag/5.2.14 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json - https://nvd.nist.gov/vuln/detail/CVE-2026-79752 - https://github.com/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/cakephp/cakephp/releases/tag/5.1.8 ## GitHub advisory CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection ### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i

CVE	CVE-2026-79752 · CVE.org
CWE	CWE-89
CVSS	Critical: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
Продукт	CakePHP
Затронуто	5.2.x до 5.2.13 включительно (также 4.5.x < 4.5.12, 4.6.x < 4.6.5, 5.1.x < 5.1.9, 5.3.x < 5.3.7)
Исправлено	5.2.14, 5.3.7, 5.1.9, 4.6.5, 4.5.12
Аутентификация	отсутствует (см. карту исходников)
Лицензия	GNU Affero GPL v3.0
Лаборатория	только `127.0.0.1` · пакет для раскрытия вендору/клиенту, не сканер

CVE-2026-79752

Популярное

Рекомендации (из карты исходников)

Точка входа

Цепочка вызовов

Предусловия лаборатории

Свидетель

Не является успехом

Патч / устранение

Воспроизведение (авторизованная лаборатория)

Образы лаборатории

Ссылки

Записи (структурированные)

Лицензия

Отказ от ответственности