See how cakephp compares to other vendors in security performance
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Latest version: 5.4.1
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches This issue has been fixed in 5.2.12 and 5.3.1
Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
End of support: 7/20/2026, Latest version: 5.3.7
End of support: 1/10/2026, Latest version: 5.2.15
End of life: 9/9/2026, End of support: 9/9/2025, Latest version: 4.6.5
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 7/5/2020, Latest version: 4.0.10