CVE-2026-119419: CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Published Oct 30, 2026

Updated

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What application code paths are exposed to this issue?

Code is exposed when an attacker can control a collation name supplied to a StringExpression or IdentifierExpression constructor, or to either object's setCollation() method. The vulnerable value is emitted after an unquoted COLLATE clause.

Does the database backend change the exposure?

The issue affects every database driver. The impact is constrained by the privileges of the database connection used by the application.

What level of access does an attacker need?

No authentication or user interaction is required according to the provided severity vector, but exploitation requires a path that passes attacker-controlled input as a collation value to the affected expression APIs.

CVE-2026-119419: CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Event History

Frequently Asked Questions

What application code paths are exposed to this issue?

Does the database backend change the exposure?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

What application code paths are exposed to this issue?

Does the database backend change the exposure?

What level of access does an attacker need?