CVE-2026-119418

EUVD-2026-113798
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
cakephpcakephp
𝑥
≤ 5.4.3
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/cakephp-window-sqli
https://github.com/cakephp/cakephp
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330
https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
https://github.com/cakephp/cakephp/pull/19735
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame