CVE-2026-79752

CakePHP 5.2.13 — cakephp

CakePHP 是一个用于 PHP 的快速开发框架。在 4.5.12、4.6.5、5.1.9、5.2.14 和 5.3.7 之前，src/Database/FunctionsBuilder.php 中的 FunctionsBuilder::cast、FunctionsBuilder::extract、FunctionsBuilder::datePart 和 FunctionsBuilder::dateAdd 接受用户可控的 dataType、part 或 unit 值，并将它们作为未转义的结构片段拼接到生成的 SQL 中。将不可信输入传递给这些参数的应用程序可能导致 SQL 注入，其机密性、完整性和可用性影响取决于数据库连接的权限。此问题已在 4.5.12、4.6.5、5.1.9、5.2.14 和 5.3.7 版本中修复。

# CVE-2026-79752 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-79752` - CWE: CWE-89 - published: 2026-09-17T15:16:51.673 ## NVD description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## MITRE description CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. ## Affected - cakephp cakephp < 4.5.12 affected, >= 4.6.0, < 4.6.5 affected, >= 5.0.0, < 5.1.9 affected, >= 5.2.0, < 5.2.14 affected, >= 5.3.0, < 5.3.7 affected - OSV: ## References (JSON sources only) - https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0 - https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e - https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676 - https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d - https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45 - https://github.com/cakephp/cakephp/pull/19520 - https://github.com/cakephp/cakephp/pull/19528 - https://github.com/cakephp/cakephp/releases/tag/4.5.12 - https://github.com/cakephp/cakephp/releases/tag/4.6.5 - https://github.com/cakephp/cakephp/releases/tag/5.1.9 - https://github.com/cakephp/cakephp/releases/tag/5.2.14 - https://github.com/cakephp/cakephp/releases/tag/5.3.7 - https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79752.json - https://nvd.nist.gov/vuln/detail/CVE-2026-79752 - https://github.com/advisories/GHSA-vjqc-q4mp-2rvf - https://github.com/cakephp/cakephp/releases/tag/5.1.8 ## GitHub advisory CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection ### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters. ## OSV CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed i

CVE	CVE-2026-79752 · CVE.org
CWE	CWE-89
CVSS	严重：9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
产品	CakePHP
受影响版本	5.2.x 至 5.2.13（以及 4.5.x < 4.5.12、4.6.x < 4.6.5、5.1.x < 5.1.9、5.3.x < 5.3.7）
已修复版本	5.2.14、5.3.7、5.1.9、4.6.5、4.5.12
认证	无（见 source map）
许可证	GNU Affero GPL v3.0
实验环境	仅限 `127.0.0.1` · 供应商/客户披露包，不是扫描器

CVE-2026-79752

最受欢迎

安全公告（来自 source map）

入口

调用链

实验环境前提条件

见证

非成功

补丁 / 修复

复现（授权实验环境）

实验镜像

参考资料

记录（结构化）

许可证

免责声明