CVE-2026-119419

EUVD-2026-113799
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
cakephpcakephp
𝑥
≤ 5.4.3
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/cakephp-collate-sqli
https://github.com/cakephp/cakephp
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/IdentifierExpression.php#L106
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/StringExpression.php#L77
https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3c
https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82
https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9
https://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595
https://github.com/cakephp/cakephp/pull/19726
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-stringexpression-and-identifierexpression-collation