Threats affecting pkg:composer/cakephp

CVE-2026-119419 is a critical SQL injection vulnerability in CakePHP versions up to 5.4.3. It arises from improper neutralization of special elements in SQL commands, specifically through unvalidated collation values supplied to StringExpression and IdentifierExpression. Attackers can inject arbitrary SQL by manipulating the collation name, potentially affecting all database drivers accessible by the connection.

CakePHP versions up to 5.4.3 contain a critical SQL injection vulnerability in the WindowExpression::range() and frame() methods. This flaw allows attackers to inject malicious SQL by supplying unvalidated frame offsets and directions, which are used in the OVER clause of SQL queries. Exploitation could lead to execution of arbitrary SQL commands with the database connection's privileges.

CVE-2026-119417 is an email header injection vulnerability in CakePHP versions 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3. The issue arises because SmtpTransport and MailTransport components only strip CRLF pairs from header values, allowing attackers to insert bare CR or LF characters via custom headers set through Message::setHeaders() or Message::addHeaders(). This can enable injection of additional headers such as Bcc, potentially redirecting or altering outgoing emails.

CVE-2026-119416 is a vulnerability in CakePHP up to version 5.4.3 involving improper cookie domain validation in the Http Client CookieCollection. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching victim domains or sending Set-Cookie Domain values for unrelated hosts can steal or inject cookies into client cookie jars.

CVE-2026-119415 is a header injection vulnerability in CakePHP versions up to 5.4.3. It allows attackers to inject MIME part headers by supplying CR/LF sequences in Content-Type and Content-ID values used in attachments or multipart HTTP client data. This can lead to arbitrary headers or content being added to MIME parts.

Multiple methods in CakePHP's FunctionsBuilder component are vulnerable to SQL injection when user-controlled data is passed to specific parameters. The affected methods are cast(), extract(), datePart(), and dateAdd(). This vulnerability allows attackers to inject malicious SQL code via the $dataType, $part, or $unit parameters. Fixed versions have been released across multiple CakePHP versions. Users are advised not to supply user-controlled data to these parameters as a workaround.