CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Latest version: 5.4.1
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches This issue has been fixed in 5.2.12 and 5.3.1
Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
End of support: 7/20/2026, Latest version: 5.3.7
End of support: 1/10/2026, Latest version: 5.2.15
End of life: 9/9/2026, End of support: 9/9/2025, Latest version: 4.6.5
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.