CVE-2026-77635

CakePHP 5.2.13 — cakephp

CakePHP 是一个用于 PHP 的快速开发框架。在各自发布线的 5.1.10、5.2.15 和 5.3.7 版本之前，FunctionsBuilder::jsonValue() 与 PostgresDriver 配合使用时，如果用户可控数据被传入 jsonPath 参数，则存在 SQL 注入漏洞。该问题已在 5.1.10、5.2.15 和 5.3.7 版本中修复。

# CVE-2026-77635 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77635` - CWE: CWE-89 - published: 2026-08-24T21:17:48.457 ## NVD description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. ## Affected - cakephp cakephp >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - cakephp cakephp/database >= 5.1.0, < 5.1.10 affected, >= 5.2.0, < 5.2.15 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3 - https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55 - https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f - https://github.com/cakephp/cakephp/releases/tag/5.1.10 - https://github.com/cakephp/cakephp/releases/tag/5.2.15 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77635.json - https://nvd.nist.gov/vuln/detail/CVE-2026-77635 - https://github.com/advisories/GHSA-fxf7-vhh8-7vpq ## GitHub advisory CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver ### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter. ### Patches 5.1.10, 5.2.15, 5.3.7 ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

CVE	CVE-2026-77635 · CVE.org
CWE	CWE-89
CVSS	严重：9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`
产品	CakePHP
受影响版本	5.2.x 至 5.2.13（还包括 5.1.x < 5.1.10、5.3.x < 5.3.7）
已修复版本	5.2.15、5.1.10、5.3.7
认证	无（见 source map）
许可证	GNU Affero GPL v3.0
实验环境	仅限 `127.0.0.1` · 供应商/客户披露包，并非扫描器

CVE-2026-77635

最受欢迎

安全公告（来自 source map）

入口

调用链

实验环境前提条件

见证

非成功情况

补丁 / 修复

复现（授权实验环境）

实验镜像

参考资料

记录（结构化）

许可证

免责声明