- Packages
- cakephp/cakephp, cakephp/database
- Fixed in
- 5.3.7, 5.2.15, 5.1.10
- Published
- Tue 8 Sep 2026, 21:56 Lisbon
- Installs on Packagist
- 21M
In plain words
An attacker can inject SQL if user-controlled data is passed to the $jsonPath parameter of FunctionsBuilder::jsonValue() when using the Postgres driver. The flaw affects both cakephp/cakephp and cakephp/database.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| cakephp/cakephp | >= 5.3.0, < 5.3.7 | 5.3.7 |
| cakephp/cakephp | >= 5.2.0, < 5.2.15 | 5.2.15 |
| cakephp/cakephp | >= 5.1.0, < 5.1.10 | 5.1.10 |
| cakephp/database | >= 5.3.0, < 5.3.7 | 5.3.7 |
| cakephp/database | >= 5.2.0, < 5.2.15 | 5.2.15 |
| cakephp/database | >= 5.1.0, < 5.1.10 | 5.1.10 |
Am I affected?
Check composer.lock for cakephp/cakephp or cakephp/database in any affected range: >= 5.1.0, < 5.1.10, >= 5.2.0, < 5.2.15 or >= 5.3.0, < 5.3.7. If present, check whether your project uses the Postgres driver and passes user-controlled data to the $jsonPath parameter of FunctionsBuilder::jsonValue().
What to do
Check which version you have, then update to a fixed release for your branch (5.3.7, 5.2.15, 5.1.10):
composer show cakephp/cakephp | grep versions
composer update cakephp/cakephpIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Do not pass user-controlled data to the $jsonPath parameter of FunctionsBuilder::jsonValue().
The advisory's description
Impact
The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches
5.1.10, 5.2.15, 5.3.7
Workarounds
Don't provide user controlled data to these functions/parameters.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
The advisory
- GitHub Advisory Database: GHSA-fxf7-vhh8-7vpq, with who is affected and how
- OSV.dev: GHSA-fxf7-vhh8-7vpq
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for cakephp/cakephp
- All advisories for cakephp/database