AIKIDO-2026-102920
cakephp/cakephp is vulnerable to SQL Injection
81
High Risk
This Affects:
cakephp/cakephpTL;DR
The FunctionsBuilder::jsonValue() method builds PostgreSQL JSON path expressions by inserting the $jsonPath argument into the generated SQL instead of binding or quoting it. This allows manipulation of the executed statement against PostgreSQL connections, exposing or altering database contents. The fix stops interpolating the path argument and treats it as a bound value so injection-like paths are rejected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the PostgreSQL driver and pass externally controlled data to the $jsonPath argument of FunctionsBuilder::jsonValue().
Background info
cakephp/cakephp is vulnerable to SQL Injection in versions 5.1.0 - 5.1.9, 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6.
How to fix this
Upgrade the cakephp/cakephp and/or the cakephp/database library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant