CVE-2026-79752: CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Applications are exposed if they use an affected CakePHP version and pass untrusted input into the dataType parameter of FunctionsBuilder::cast, the part parameter of FunctionsBuilder::extract or FunctionsBuilder::datePart, or the unit parameter of FunctionsBuilder::dateAdd.
What does an attacker need to exploit this issue?
An attacker needs a way to influence one of the affected parameters through application input. The vulnerable values are inserted into generated SQL as unescaped structural fragments.
Are applications using CakePHP defaults automatically vulnerable?
The issue requires application code to pass untrusted input to the affected parameters. The provided information does not indicate that normal default use without untrusted values is exploitable.
What is the remediation?
Upgrade to CakePHP 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7, or a later version in the applicable release line. If upgrading cannot happen immediately, prevent untrusted input from reaching the affected dataType, part, and unit parameters.
How can teams assess whether they are affected?
Review uses of FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd, and trace the values supplied to dataType, part, and unit. Treat any value that can be influenced by a request, user-controlled record, or other untrusted source as affected.