See how cakephp compares to other vendors in security performance
MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.
Impact The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes
Workarounds Don't provide user controlled data to these functions/parameters.
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds You can strip CRLF bytes from email header values before setting header values.
Impact The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches 5.1.10, 5.2.15, 5.3.7
Workarounds Don't provide user controlled data to these functions/parameters.
Latest version: 5.4.2
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches This issue has been fixed in 5.2.12 and 5.3.1
Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
End of support: 7/20/2026, Latest version: 5.3.7
End of support: 1/10/2026, Latest version: 5.2.15
End of life: 9/9/2026, End of support: 9/9/2025, Latest version: 4.6.5
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 6/20/2021, Latest version: 3.9.10