[CRITICAL] CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

PKSA-vxgj-bmcq-9b6x CVE-2026-79752 GHSA-vjqc-q4mp-2rvf

Affected version: >=5.3.0,<5.3.7|>=5.2.0,<5.2.14|>=5.0.0,<5.1.9|>=4.6.0,<4.6.5|<4.5.12

Reported by:
GitHub

[MEDIUM] CakePHP: View::element() is missing a path containment check

PKSA-wx2k-k564-z67n CVE-2026-48820 GHSA-wpvj-hjcr-h3p2

Affected version: <4.5.11|>=4.6.0,<4.6.4|>=5.0.0,<5.1.7|>=5.2.0,<5.2.13|>=5.3.0,<5.3.6

Reported by:
GitHub

[HIGH] CakePHP allows method override parameters to bypass CSRF checks

PKSA-r2cj-nv22-p8zs CVE-2020-35239 GHSA-9pgx-pf36-w46r

Affected version: >=4.1.0,<4.1.4|>=4.0.0,<4.0.10

Reported by:
GitHub

[MEDIUM] Cross-Site Request Forgery in CakePHP

PKSA-8jvz-y796-qyx9 CVE-2020-15400 GHSA-j33j-fg2g-mcv2

Affected version: <3.10.3|>=4.0.0,<4.0.6

Reported by:
GitHub