Every CVE Search/ Get API key

CVE-2026-77635

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

9.2 CriticalPublic exploitFix available

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.49%Up 0.2 points since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
CVE-2026-77635
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-65121 9.2

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
EUVD-2026-65121
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fxf7-vhh8-7vpq 9.2

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Impact

The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.

Patches

5.1.10, 5.2.15, 5.3.7

Workarounds

Don't provide user controlled data to these functions/parameters.

Record
GHSA-fxf7-vhh8-7vpq
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-89
Updated
2026-11-02
NVD 9.2

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
CVE-2026-77635
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-89
Updated
2026-11-02
OSV 9.2

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
CVE-2026-77635
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-89
Updated
2026-11-02
OSVDEBIAN-CVE-2026-77635 9.2

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
DEBIAN-CVE-2026-77635
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-fxf7-vhh8-7vpq 9.2

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Impact

The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.

Patches

5.1.10, 5.2.15, 5.3.7

Workarounds

Don't provide user controlled data to these functions/parameters.

Record
GHSA-fxf7-vhh8-7vpq
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-89
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77635 9.2

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Record
UBUNTU-CVE-2026-77635
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cakephp/cakephp
Packagist
 5.3.0 up to 5.3.7
5.3.7
cakephp/cakephp
Packagist
 5.2.0 up to 5.2.15
5.2.15
cakephp/cakephp
Packagist
 5.1.0 up to 5.1.10
5.1.10
cakephp/database
Packagist
 5.3.0 up to 5.3.7
5.3.7
cakephp/database
Packagist
 5.2.0 up to 5.2.15
5.2.15
cakephp/database
Packagist
 5.1.0 up to 5.1.10
5.1.10
cakephp
Debian:11
 All versions, plus listed versions
2.10.11-2.12.10.24-12.10.24-2
 None known
cakephp/cakephp
Packagist
 5.3.0 up to 5.3.7, plus listed versions
5.3.15.3.25.3.35.3.45.3.55.3.6
5.3.7
cakephp/cakephp
Packagist
 5.2.0 up to 5.2.15, plus listed versions
5.2.15.2.105.2.115.2.125.2.13
Show 9 moreShow less
5.2.145.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.15
cakephp/cakephp
Packagist
 5.1.0 up to 5.1.10, plus listed versions
5.1.15.1.25.1.45.1.55.1.65.1.75.1.85.1.9
5.1.10
Show 6 moreShow less
Affected packages
PackageAffectedFixed
cakephp/database
Packagist
 5.3.0 up to 5.3.7, plus listed versions
5.3.25.3.35.3.45.3.55.3.6
5.3.7
cakephp/database
Packagist
 5.2.0 up to 5.2.15, plus listed versions
5.2.15.2.105.2.115.2.125.2.13
Show 9 moreShow less
5.2.145.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.15
cakephp/database
Packagist
 5.1.0 up to 5.1.10, plus listed versions
5.1.15.1.25.1.45.1.55.1.65.1.85.1.9
5.1.10
cakephp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1
 None known
cakephp
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.10.11-2
 None known
cakephp
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.10.11-2.12.10.24-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubabraxas/CVE-2026-776352026-09-19

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77635 is a critical vulnerability (CVSS 9.2) in Cakephp, published August 24, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in cakephp/cakephp 5.3.7.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open