CVE-2026-119419 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
CriticalCVSS 9.2
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cakephp/cakephp | <= 5.4.3 | No fix listed |
| ubuntu/cakephp(Ubuntu:22.04) | All versions | No fix listed |
References
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com issue-tracking patch
- github.com technical-description
- github.com technical-description
- abraxaslabs.tech third-party-advisory
- github.com product
- VulnCheck Advisory: CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation third-party-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org