CVE-2026-79752: CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
Impact The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds Don't provide user controlled data to these functions/parameters.
Other sources
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.
— MITRE
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7 - Configuration
Ensure the $dataType, $part, and $unit parameters passed to FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd are not user-controlled (because in versions prior to 4.5.12/4.6.5/5.1.9/5.2.14/5.3.7 these values are incorporated into generated SQL as unescaped structural fragments).
CakePHP src/Database/FunctionsBuilder.php FunctionsBuilder::cast($field, $dataType), FunctionsBuilder::extract($part, $expr), FunctionsBuilder::datePart($part, $expr), FunctionsBuilder::dateAdd($expr, $value, $unit) input handling = Do not pass user-controlled values to the structural parameters ($dataType / $part / $unit)
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Applications are exposed if they use an affected CakePHP version and pass untrusted input into the dataType parameter of FunctionsBuilder::cast, the part parameter of FunctionsBuilder::extract or FunctionsBuilder::datePart, or the unit parameter of FunctionsBuilder::dateAdd.
What does an attacker need to exploit this issue?
An attacker needs a way to influence one of the affected parameters through application input. The vulnerable values are inserted into generated SQL as unescaped structural fragments.
Are applications using CakePHP defaults automatically vulnerable?
The issue requires application code to pass untrusted input to the affected parameters. The provided information does not indicate that normal default use without untrusted values is exploitable.
What is the remediation?
Upgrade to CakePHP 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7, or a later version in the applicable release line. If upgrading cannot happen immediately, prevent untrusted input from reaching the affected dataType, part, and unit parameters.
How can teams assess whether they are affected?
Review uses of FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd, and trace the values supplied to dataType, part, and unit. Treat any value that can be influenced by a request, user-controlled record, or other untrusted source as affected.