CVE-2026-119418

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

State: Published
Severity: 9.2 Critical
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 30, 2026

Description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
cakephpcakephp	5.4.3 and earlierAffected

References

https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565patch
https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9patch
https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1fpatch
https://github.com/cakephp/cakephp/pull/19735patchissue-tracking
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152technical-description
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330technical-description
https://abraxaslabs.tech/research/cakephp-window-sqlithird-party-advisory
https://github.com/cakephp/cakephpproduct
VulnCheck Advisory: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.