NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionGHSA-vjqc-q4mp-2rvf

Fix: cakephp/cakephp#19528

GHSA-vjqc-q4mp-2rvf is a SQL Injection vulnerability in cakephp/database. A fix is available for cakephp/database — see the affected versions and patch details below.

Also known asCVE-2026-79752
Published
Updated
Affected
10 pkgs
Patched
10 / 10
Exploits
None indexed
Exploitation data as of Oct 31, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-vjqc-q4mp-2rvf.

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs50th percentile — riskier than 50% of all scored CVEsHighest risk
0.12%0.45%0.79%1.12%0.6%0.6%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

10 pkgs affected
🐘cakephp/database🐘cakephp/database🐘cakephp/database🐘cakephp/database🐘cakephp/database🐘cakephp/cakephp🐘cakephp/cakephp🐘cakephp/cakephp+2 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Affected Packages

10 total 10 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcakephp/database≥ 3.0.0&&< 4.5.124.5.12composer require cakephp/database:^4.5.12
🐘Packagistcakephp/database≥ 4.6.0&&< 4.6.54.6.5composer require cakephp/database:^4.6.5
🐘Packagistcakephp/database≥ 5.0.0&&< 5.1.95.1.9composer require cakephp/database:^5.1.9
🐘Packagistcakephp/database≥ 5.2.0&&< 5.2.145.2.14composer require cakephp/database:^5.2.14
🐘Packagistcakephp/database≥ 5.3.0&&< 5.3.75.3.7composer require cakephp/database:^5.3.7
🐘Packagistcakephp/cakephpall versions4.5.12composer require cakephp/cakephp:^4.5.12

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for cakephp/database, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update cakephp/database to 4.5.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vjqc-q4mp-2rvf is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters. ### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes ### Workarounds Don't provide user controlled data to these functions/parameters.
O3 Security · Impact-Aware SCA

Is GHSA-vjqc-q4mp-2rvf in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CakePHP: Multiple methods in FunctionsBuilder…