Cakephp: In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName()… (CVE-2026-48820)
CakePHP versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5 contain a vulnerability in the View::_getElementFileName() function. This function does not verify that the resolved element path is confined to the application or plugin view template directories. Crafted user input can exploit this to include arbitrary PHP files on the server. Patched versions have been released to address this issue.
AI Analysis
Technical Summary
The vulnerability in CakePHP affects multiple version ranges where the View::_getElementFileName() method fails to ensure that the resolved element path remains within the intended application or plugin view template paths. This path traversal weakness allows an attacker to supply crafted element names that cause the inclusion of unintended PHP files on the server, potentially leading to code execution or information disclosure. The issue is fixed in CakePHP versions 4.5.11 (patch release), 4.6.4, 5.1.7, 5.2.13, and 5.3.6.
Potential Impact
An attacker can leverage this vulnerability to include arbitrary PHP files on the server by manipulating element names. This can lead to unauthorized code execution or disclosure of sensitive information depending on the included files. The vulnerability requires crafted user input and is mitigated by patching.
Mitigation Recommendations
Patched releases are available and should be applied: 4.5.11, 4.6.4, 5.1.7, 5.2.13, and 5.3.6. Upgrading to these versions will remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.
Cakephp: In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName()… (CVE-2026-48820)
Description
CakePHP versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5 contain a vulnerability in the View::_getElementFileName() function. This function does not verify that the resolved element path is confined to the application or plugin view template directories. Crafted user input can exploit this to include arbitrary PHP files on the server. Patched versions have been released to address this issue.
CVSS v4.0
Affected software
pkg:deb/ubuntu/cakephp?arch=source&distro=xenialpkg:deb/ubuntu/cakephp?arch=source&distro=focalpkg:deb/ubuntu/cakephp?arch=source&distro=jammyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in CakePHP affects multiple version ranges where the View::_getElementFileName() method fails to ensure that the resolved element path remains within the intended application or plugin view template paths. This path traversal weakness allows an attacker to supply crafted element names that cause the inclusion of unintended PHP files on the server, potentially leading to code execution or information disclosure. The issue is fixed in CakePHP versions 4.5.11 (patch release), 4.6.4, 5.1.7, 5.2.13, and 5.3.6.
Potential Impact
An attacker can leverage this vulnerability to include arbitrary PHP files on the server by manipulating element names. This can lead to unauthorized code execution or disclosure of sensitive information depending on the included files. The vulnerability requires crafted user input and is mitigated by patching.
Mitigation Recommendations
Patched releases are available and should be applied: 4.5.11, 4.6.4, 5.1.7, 5.2.13, and 5.3.6. Upgrading to these versions will remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-48820
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ab4be68f7a7c54106f0d41b
Added to database: 09/24/2026, 06:08:40 UTC
Last enriched: 09/24/2026, 06:51:49 UTC
Last updated: 09/25/2026, 01:47:43 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.