CVE-2026-119419

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

9.2 Critical

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.39%Unchanged since Oct 31, 2026

What each source reports

CVE List Score used 9.2

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Record: CVE-2026-119419
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-04

EUVDEUVD-2026-113799 9.2

Record: EUVD-2026-113799
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-6q38-2qcr-3x34 9.2

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL...

Record: GHSA-6q38-2qcr-3x34
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

NVD 9.2

Record: CVE-2026-119419
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-04

OSV 9.2

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Record: CVE-2026-119419
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-05

OSVUBUNTU-CVE-2026-119419 9.2

Record: UBUNTU-CVE-2026-119419
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

OSVCLSA-2026-1793803616 No score

TuxCare security update for cakephp/cakephp (5 CVEs)

TuxCare rebuilt cakephp/cakephp to address 5 CVEs. Fixed in 5.0.11-p2+tuxcare.

Record: CLSA-2026-1793803616
Updated: 2026-11-04

Affected products

cakephp

Affected packages

Affected packages
Package	Affected	Fixed
`cakephp/cakephp` TuxCare:Packagist From an advisory covering 5 CVEs	5.0.11 up to 5.0.11-p2+tuxcare, plus listed versions 5.0.11-p1+tuxcare	5.0.11-p2+tuxcare
`cakephp` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1	None known
`cakephp` Ubuntu:20.04:LTS	All versions, plus listed versions 2.10.11-2	None known
`cakephp` Ubuntu:22.04:LTS	All versions, plus listed versions 2.10.11-2.12.10.24-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 4, 2026	affected, aliases, facts	CVE List, EUVD, NVD, OSV
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119419 is a critical vulnerability (CVSS 9.2) in Cakephp, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.

References

Show 9 moreShow less