CVE-2026-119419
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
- CVSS 4.0
- 9.2 CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.39% probability · 34th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Source
- disclosure@vulncheck.com
EPSS moved from 0.4% on 31 October 2026 to 0.4% on 3 November 2026.
References
- https://abraxaslabs.tech/research/cakephp-collate-sqli
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/IdentifierExpression.php#L106
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/StringExpression.php#L77
- https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3c
- https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82
- https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9
- https://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595
- https://github.com/cakephp/cakephp/pull/19726
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-stringexpression-and-identifierexpression-collation
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.