External risk intelligence

CakePHP SQL Injection via Window Expression Range and Frame.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-119418

CakePHP is a widely used web application framework. Vulnerabilities in framework database layers that handle user-supplied input are commonly reachable via public-facing web application endpoints, such as search functions, filters, or form submissions, which are standard components of internet-accessible web applications.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the CakePHP framework allows attackers to inject SQL code by manipulating input related to window frame offsets and directions. This could enable attackers to execute arbitrary SQL commands with the privileges of the application's database connection, potentially leading to unauthorized data access or modification.

SQL injection risk in CakePHP framework.
Affects applications using specific database functions.
Confirm relevance and exposure to critical data.

Attack Path

How an attacker could exploit the issue

An attacker could target applications using CakePHP by sending specially crafted input to features that forward user data into SQL queries. If these inputs are not properly validated, they can manipulate the `WindowExpression::range()` and `frame()` functions to inject malicious SQL commands. Successful injection would allow the attacker to execute arbitrary SQL with the database's permissions.

Entry condition: Unvalidated user input is accepted.
Trigger point: Specific `WindowExpression` functions are called.
Resulting risk: Arbitrary SQL execution with database privileges.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in CakePHP could allow attackers to execute arbitrary SQL queries with database connection privileges when user input is improperly handled in WindowExpression functions. This could affect database integrity and potentially expose sensitive information stored within the database.

Database integrity and data could be at risk.
Crafted input could be forwarded to the application.
Attacker can execute SQL with database privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this SQL injection vulnerability in CakePHP. The first practical step is to identify all instances of the affected framework version, confirm their accessibility and business criticality, and then assign ownership to the respective accountable team for remediation planning.

Verify application inventory and exposure.
Confirm accountable application owners.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CakePHP?

CakePHP is an open-source web application framework written in PHP. Developers use it to build dynamic websites and web services by providing a structured foundation that handles common tasks like database interaction, routing, and authentication. It simplifies building complex applications by offering tools that interface directly with databases, but it relies on proper input handling to remain secure when processing data provided by end users.

What does SQL injection mean for CVE-2026-119418?

This vulnerability is classified as SQL injection (CWE-89). It occurs when an application takes untrusted input and includes it in a database query without sufficient validation. In this specific case, the flaw exists within the framework's internal handling of windowing expressions. If an attacker submits specially crafted data, they can trick the database into running unintended commands, effectively bypassing the application's intended logic to perform unauthorized operations.

How is this SQL injection triggered?

The vulnerability is triggered when an application passes user-controlled data into the 'range()' or 'frame()' methods within the 'WindowExpression' component. The bug does not trigger if user input is never processed by these specific database functions. If your application logic restricts these inputs to strictly controlled, hardcoded values rather than accepting them from web requests, the execution path for this vulnerability is not engaged.

How does Halo Surface Signal assess this risk?

Halo Surface Signal flags this as 'Likely' because CakePHP is a common framework used to power public-facing web applications. Because this vulnerability exists in the database layer, any internet-accessible endpoint—such as a search filter, dashboard control, or data entry form—that feeds user input into these specific windowing functions could potentially be used by an attacker to reach the underlying database.

What are the first steps to address this?

Start by auditing your software inventory to locate every instance of the CakePHP framework version 5.4.3 or earlier currently in your environment. Once identified, evaluate which of these instances handle external-facing traffic, as these are the highest priority for protection. Coordinate with your application development teams to confirm ownership and schedule updates to the framework, as this is a fundamental library component that requires remediation at the source.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.