External risk intelligence

CakePHP SQL Injection via Unvalidated Collation Values

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-119419

CakePHP is a widely used web application framework. Vulnerabilities in framework database abstraction layers are frequently reachable via public-facing web application endpoints, as they process user-supplied input in standard web request flows.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the CakePHP framework, impacting its database interaction components. This issue allows for SQL injection by manipulating unvalidated collation values, potentially enabling unauthorized data access or modification across database drivers. The primary concern is to confirm if this specific technology is in use and assess any potential exposure.

Unvalidated input allows database code injection.
Impacts database security and data integrity.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to an application built with an affected version of CakePHP. This data would be processed by the StringExpression or IdentifierExpression components, leading to an SQL injection. The successful exploitation could allow an attacker to execute arbitrary SQL commands within the database, potentially leading to data compromise or manipulation.

Unvalidated collation values are supplied.
StringExpression and IdentifierExpression are triggered.
Arbitrary SQL commands can be executed.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unvalidated collation values supplied to CakePHP's StringExpression and IdentifierExpression could allow an attacker to append SQL statements. This could affect all database drivers within the connection's privileges when an attacker controls a collation name.

Database connection privileges could be compromised.
SQL injection via unvalidated collation names.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this SQL injection vulnerability in CakePHP. The first practical step is to identify all instances of the affected CakePHP version, determine their exposure and business criticality, and then locate the accountable owner for each instance to plan remediation.

Identify application owners and affected systems.
Verify public exposure and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CakePHP and how is it used?

CakePHP is a popular open-source web application framework written in PHP. Developers use it to build dynamic websites and web services by providing a structured way to interact with databases and handle incoming requests efficiently.

What does CVE-2026-119419 mean for database security?

This vulnerability is classified as CWE-89, or SQL Injection. It occurs when the framework incorrectly handles collation settings. Because the application fails to sanitize these values, an attacker can append unauthorized SQL commands, allowing them to manipulate the database.

How can an attacker trigger this SQL injection?

An attacker triggers this by supplying malicious input as a collation value to the StringExpression or IdentifierExpression components. This bug does not trigger if the application does not allow user input to reach these specific database abstraction methods.

Is my application vulnerable to CVE-2026-119419?

According to Halo Surface Signal, this vulnerability is likely relevant to public-facing applications. Since web apps frequently process user input through database abstraction layers, any instance of CakePHP up to version 5.4.3 should be checked.

What should I do if I use an affected version of CakePHP?

Begin by inventorying your applications to identify which ones use the impacted framework versions. Once identified, evaluate the specific endpoints for connectivity to the public internet and coordinate with your development team to apply official patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.