Critical severity · published Aug 24, 2026
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
9.2
CVSS
0.5%
EPSS
No
On KEV
Description
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cakephp · cakephp
>= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7 · source: vendor
CA
cakephp/database · cakephp
>= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77635
github.com
https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
github.com
https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
github.com
https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
github.com
https://github.com/cakephp/cakephp/releases/tag/5.1.10
github.com
https://github.com/cakephp/cakephp/releases/tag/5.2.15
github.com
https://github.com/cakephp/cakephp/releases/tag/5.3.7
More from cakephp
9.8
CVE-2023-22727
Database Query::offset() and limit() vulnerable to SQL injection in cakephp
9.2
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
8.8
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3
8.8
CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter
8.2
CVE-2026-77634
CakePHP: SmtpTransport vulnerable to CRLF header injection