Live › vulnerability › CVE-2026-119419
CakePHP through 5.4.3 passes collation names from StringExpression and IdentifierExpression into SQL without validation. An attacker who controls a collation name can append SQL after the COLLATE clause and run it with the database privileges of the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that use CakePHP 5.4.3 or earlier and build collation names from user input. Applications that only use hard-coded collation values are not exposed through this path. The sources do not say whether other code paths are affected.
No product ranges from the sources yet.
composer show cakephp/cakephpsetCollation() or to the StringExpression or IdentifierExpression constructorsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-119419")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.