Live › vulnerability › CVE-2026-119418
CakePHP through 5.4.3 does not validate frame offsets and directions passed to WindowExpression::range() and frame(). An attacker who can pass crafted values through user input into the OVER clause can run SQL with the database connection's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications built on CakePHP 5.4.3 or earlier that forward user-supplied input into window function frame clauses (OVER ... RANGE/frame) are exposed. Applications that do not use window expressions with user input, or that hard-code frame values, are less likely to be affected. unknown whether other code paths are reachable.
No product ranges from the sources yet.
composer.lock or with bin/cake --version.WindowExpression::range() or frame() that take values from user input.5.4.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-119418")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.