CVE-2026-119418
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
| CWE | CWE-89 |
| Vendor | cakephp |
| Product | cakephp |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for cakephp cakephp
Be the first to know when new high vulnerabilities affecting cakephp cakephp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
cakephp / cakephp
0 ≤ 5.4.3
References
github.com: https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565 github.com: https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9 github.com: https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f github.com: https://github.com/cakephp/cakephp/pull/19735 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330 abraxaslabs.tech: https://abraxaslabs.tech/research/cakephp-window-sqli github.com: https://github.com/cakephp/cakephp vulncheck.com: https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
Credits
Abraxas Labs Mark Story