CVE-2026-23643: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches This issue has been fixed in 5.2.12 and 5.3.1
Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
Other sources
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23643?
CVE-2026-23643 is classified as a medium severity vulnerability due to its potential for reflected cross-site scripting attack.
How do I fix CVE-2026-23643?
To fix CVE-2026-23643, upgrade CakePHP to version 5.2.12 or later.
Which versions of CakePHP are affected by CVE-2026-23643?
CVE-2026-23643 affects CakePHP versions between 5.2.12 and 5.3.1 inclusive.
What type of vulnerability is CVE-2026-23643?
CVE-2026-23643 is a reflected cross-site scripting (XSS) vulnerability.
Is CVE-2026-23643 specific to certain methods in CakePHP?
Yes, CVE-2026-23643 specifically affects the PaginatorHelper::limitControl() method in CakePHP.