---
id: "CVE-2026-119419"
kind: "vulnerability"
aliases: ["CVE-2026-119419"]
title: "CakePHP: unvalidated collation names let attackers inject SQL"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cakephp", "php", "runtime", "web-apps"]
not_affected_if: ["hard-coded-collation", "no-user-input-in-queries"]
published_at: "2026-10-30T12:16:38+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:31:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119419", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# CakePHP: unvalidated collation names let attackers inject SQL

CakePHP through 5.4.3 passes collation names from StringExpression and IdentifierExpression into SQL without validation. An attacker who controls a collation name can append SQL after the COLLATE clause and run it with the database privileges of the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CakePHP version with `composer show cakephp/cakephp`
- Look for code that passes user-supplied values to `setCollation()` or to the `StringExpression` or `IdentifierExpression` constructors

## Fix

- CakePHP: unknown; the sources do not name a fixed version

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119419

## From the sources

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_