UBUNTU-CVE-2026-119419: SQL Injection
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CakePHP through 5.4.3 are exposed if attacker-controlled input can reach the collation argument of StringExpression or IdentifierExpression, including through their constructors or setCollation(). The issue affects every database driver, with impact limited by the privileges of the application's database connection.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. Exploitation does require an attacker to control a collation name that the application passes into one of the affected expression APIs.
What is the immediate mitigation if patching cannot be performed?
Do not pass unvalidated or user-controlled collation values to StringExpression, IdentifierExpression, or setCollation(). Restrict collation selection to a fixed allowlist of expected values and ensure the database account has only the privileges required by the application.