Every CVE Search/ Get API key

CVE-2026-48820

CakePHP: View::element() is missing a path containment check

6.3 MediumFix available

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.26%Unchanged since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

CakePHP: View::element() is missing a path containment check

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
CVE-2026-48820
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-98, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-37807 6.3

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
EUVD-2026-37807
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wpvj-hjcr-h3p2 6.3

CakePHP: View::element() is missing a path containment check

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

Record
GHSA-wpvj-hjcr-h3p2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.3

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
CVE-2026-48820
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-22, CWE-98
Updated
2026-11-02
OSV 6.3

CakePHP: View::element() is missing a path containment check

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
CVE-2026-48820
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22, CWE-98
Updated
2026-11-02
OSVDEBIAN-CVE-2026-48820 6.3

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
DEBIAN-CVE-2026-48820
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-wpvj-hjcr-h3p2 6.3

CakePHP: View::element() is missing a path containment check

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

Record
GHSA-wpvj-hjcr-h3p2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVUBUNTU-CVE-2026-48820 6.3

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Record
UBUNTU-CVE-2026-48820
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
OSVCLSA-2026-1783904619 No score

TuxCare security update for cakephp/cakephp (1 CVE)

TuxCare rebuilt cakephp/cakephp to address 1 CVE. Fixed in 2.10.24-p2+tuxcare.

Record
CLSA-2026-1783904619
Updated
2026-11-02
OSVCLSA-2026-1791987574 No score

TuxCare security update for cakephp/cakephp (3 CVEs)

TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 5.0.11-p1+tuxcare.

Record
CLSA-2026-1791987574
Updated
2026-11-02
OSVCLSA-2026-1791988278 No score

TuxCare security update for cakephp/cakephp (3 CVEs)

TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 4.4.18-p1+tuxcare.

Record
CLSA-2026-1791988278
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cakephp/cakephp
Packagist
 5.3.0 up to 5.3.6
5.3.6
cakephp/cakephp
Packagist
 5.2.0 up to 5.2.13
5.2.13
cakephp/cakephp
Packagist
 5.0.0 up to 5.1.7
5.1.7
cakephp/cakephp
Packagist
 4.6.0 up to 4.6.4
4.6.4
cakephp/cakephp
Packagist
 before 4.5.11
4.5.11
cakephp/cakephp
TuxCare:Packagist
 2.10.24 up to 2.10.24-p2+tuxcare, plus listed versions
2.10.24-p1+tuxcare
2.10.24-p2+tuxcare
cakephp/cakephp
TuxCare:Packagist
From an advisory covering 3 CVEs
 5.0.11 up to 5.0.11-p1+tuxcare
5.0.11-p1+tuxcare
cakephp/cakephp
TuxCare:Packagist
From an advisory covering 3 CVEs
 4.4.18 up to 4.4.18-p1+tuxcare
4.4.18-p1+tuxcare
cakephp
Debian:11
 All versions, plus listed versions
2.10.11-2.12.10.24-12.10.24-2
 None known
cakephp/cakephp
Packagist
 5.3.0 up to 5.3.6, plus listed versions
5.3.15.3.25.3.35.3.45.3.5
5.3.6
Show 7 moreShow less
Affected packages
PackageAffectedFixed
cakephp/cakephp
Packagist
 5.2.0 up to 5.2.13, plus listed versions
5.2.15.2.105.2.115.2.125.2.2
Show 7 moreShow less
5.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.13
cakephp/cakephp
Packagist
 5.0.0 up to 5.1.7, plus listed versions
5.0.15.0.105.0.115.0.25.0.3
Show 14 moreShow less
5.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.15.1.25.1.45.1.55.1.6
5.1.7
cakephp/cakephp
Packagist
 4.6.0 up to 4.6.4, plus listed versions
4.6.14.6.24.6.3
4.6.4
cakephp/cakephp
Packagist
 before 4.5.11, plus listed versions
2.10.02.10.0-RC12.10.12.10.102.10.11
Show 45 moreShow less
2.10.122.10.132.10.142.10.152.10.162.10.172.10.182.10.192.10.22.10.202.10.212.10.222.10.232.10.242.10.32.10.42.10.52.10.62.10.72.10.82.10.92.4.102.4.52.4.62.4.72.4.82.4.92.5.02.5.0-RC12.5.0-RC22.5.0-beta2.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.0-RC12.6.0-beta2.6.12.6.10
4.5.11
cakephp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1
 None known
cakephp
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.10.11-2
 None known
cakephp
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.10.11-2.12.10.24-1
 None known

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48820 is a medium vulnerability (CVSS 6.3) in Cakephp, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in cakephp/cakephp 5.3.6.

References

This page doesn't list everything

Left out here: 339 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open