CVE-2026-77635: CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using CakePHP with PostgresDriver are affected if they use FunctionsBuilder::jsonValue() and supply user-controlled data to its jsonPath parameter. The issue affects versions before 5.1.10, 5.2.15, and 5.3.7 on their respective release lines.
What must an attacker be able to control to exploit this issue?
An attacker must be able to influence the jsonPath argument passed to FunctionsBuilder::jsonValue() in an application using PostgresDriver. The provided data does not establish that a default application configuration exposes such a path.
How can I remediate the issue?
Upgrade to CakePHP 5.1.10, 5.2.15, or 5.3.7, as appropriate for the release line in use. If upgrading cannot happen immediately, do not pass user-controlled values into the jsonPath parameter.