UBUNTU-CVE-2026-119418
Dashboard / Vulnerabilities / UBUNTU-CVE-2026-119418
Summary:
Details: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
References: https://ubuntu.com/security/CVE-2026-119418, https://www.cve.org/CVERecord?id=CVE-2026-119418, https://abraxaslabs.tech/research/cakephp-window-sqli, https://github.com/cakephp/cakephp, https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152, https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330, https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565, https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f, https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9, https://github.com/cakephp/cakephp/pull/19735, https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
Affected packages
Package
Name: cakephp
Purl: pkg:deb/ubuntu/cakephp?arch=source&distro=esm-apps-legacy%2Fxenial
Affected ranges
Type: ECOSYSTEM
Events:
