USN-8978-1: cakephp vulnerability
Published Nov 3, 2026
·Updated
Dawid Golunski discovered that CakePHP incorrectly trusted the CLIENT-IP HTTP header when determining the client IP address. A remote attacker could possibly use this issue to spoof their IP address.
Affected Software
3 affected componentsFixes available
ubuntu/cakephp<2.8.0-1ubuntu0.1~esm1
2.8.0-1ubuntu0.1~esm1
All of the following
ubuntu/cakephp<2.8.0-1ubuntu0.1~esm1
2.8.0-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/cakephpto a version that resolves this vulnerability.Fixed in 2.8.0-1ubuntu0.1~esm1
Event History
Nov 3, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Advisory Published
via OSV·05:33 PM
Data Sourced
via OSV·05:33 PM
DescriptionAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to be able to send HTTP requests to the affected CakePHP application and supply a forged CLIENT-IP header.
2
What is the practical impact of a spoofed client IP address?
Systems or application logic that rely on CakePHP's client IP determination may treat the request as originating from the spoofed address rather than the attacker's actual address.