CVE-2026-119418: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Published Oct 30, 2026

Updated

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using CakePHP through 5.4.3 are exposed when they forward attacker-controlled input into WindowExpression::range() or frame(), particularly values used for window-frame offsets or directions in an SQL OVER clause.

What does an attacker need to exploit it?

An attacker needs a path to supply crafted values that the application passes unvalidated to the affected window-expression methods. No authentication or user interaction is required according to the supplied severity vector, but exploitation has high attack complexity.

What is the likely impact of successful exploitation?

Injected SQL executes with the privileges of the application's database connection. This can affect the confidentiality, integrity, and availability of data accessible to that connection.

How can teams assess whether they are affected?

Identify deployments using CakePHP through 5.4.3, then review code for calls to WindowExpression::range() and frame(). Prioritize calls where frame offsets or directions originate from request parameters or other untrusted input without strict validation.

What can be done if updating is not immediately possible?

Prevent untrusted input from reaching range() or frame(). Use fixed, application-defined frame directions and strictly validate frame offsets before constructing the window expression.

CVE-2026-119418: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

How can teams assess whether they are affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

How can teams assess whether they are affected?

What can be done if updating is not immediately possible?