CVE-2026-77635: CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Impact The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches 5.1.10, 5.2.15, 5.3.7
Workarounds Don't provide user controlled data to these functions/parameters.
Other sources
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7 - Configuration
Do not provide user controlled data to FunctionsBuilder::jsonValue($field, $jsonPath) when using the PostgresDriver; ensure the $jsonPath argument is not derived from user input.
CakePHP FunctionsBuilder::jsonValue() (PostgresDriver) Do not pass user-controlled data to jsonPath parameter = Ensure $jsonPath is not user-controlled
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using CakePHP with PostgresDriver are affected if they use FunctionsBuilder::jsonValue() and supply user-controlled data to its jsonPath parameter. The issue affects versions before 5.1.10, 5.2.15, and 5.3.7 on their respective release lines.
What must an attacker be able to control to exploit this issue?
An attacker must be able to influence the jsonPath argument passed to FunctionsBuilder::jsonValue() in an application using PostgresDriver. The provided data does not establish that a default application configuration exposes such a path.
How can I remediate the issue?
Upgrade to CakePHP 5.1.10, 5.2.15, or 5.3.7, as appropriate for the release line in use. If upgrading cannot happen immediately, do not pass user-controlled values into the jsonPath parameter.