The FunctionsBuilder methods cast($field, $dataType), extract($part, $expr), datePart($part, $expr), and dateAdd($expr, $value, $unit) in CakePHP's database package are vulnerable to SQL injection if untrusted input is provided to the $dataType, $part, or $unit parameters. This vulnerability is tracked as CVE-2026-79752 and affects multiple versions of CakePHP prior to the patched releases 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. The vulnerability allows an attacker to execute arbitrary SQL commands by injecting malicious input into these parameters.

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. This classifies the vulnerability as critical.

Official patches are available in CakePHP versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. Users should upgrade to these versions to remediate the vulnerability. As a temporary workaround, do not pass user-controlled data to the $dataType, $part, or $unit parameters of the affected FunctionsBuilder methods.