External risk intelligence

CakePHP FunctionsBuilder SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-77635

CakePHP is a widely used web development framework. Applications built with it are commonly deployed as internet-facing web applications, making components that handle user-controlled data in database queries directly reachable and exposed to the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

CakePHP, a popular PHP development framework, has a critical vulnerability where a function can be exploited for SQL injection if specific user input is provided. This could potentially allow unauthorized access or manipulation of data within applications built using the affected framework.

Unsanitized input can lead to database breaches.
Confirms relevance for applications using this framework.
Assess exposure for any CakePHP-based systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending specially crafted input to a CakePHP application using PostgresDriver. This input targets the `jsonValue()` function, which improperly handles user-supplied data in the `jsonPath` parameter, potentially leading to unauthorized access or modification of sensitive data.

No authentication or privileges needed.
User-supplied data in `jsonPath` parameter.
SQL injection leading to data compromise.

Live Threat

Current exploitation, exposure, and threat context

When user-controlled data is supplied to the `jsonPath` parameter in CakePHP's `FunctionsBuilder::jsonValue()` function with the `PostgresDriver`, it could lead to SQL injection. This occurs when the application uses this specific function and driver combination, potentially exposing sensitive database information or allowing unauthorized modification of data.

Database contents and integrity
Via crafted `jsonPath` input
Unauthorized data access or modification

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, application owners are primarily responsible for addressing this SQL injection vulnerability within the CakePHP framework, especially since it affects user-controlled data in database queries. The first practical move involves identifying all instances of the affected CakePHP versions, confirming their reachability from external networks, and assessing business criticality to prioritize remediation efforts. Once accountable owners are identified, a risk-based plan for applying necessary updates or implementing temporary mitigations should be developed.

Application owners should manage this issue.
Verify external reachability and business criticality.
Plan and execute updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CakePHP?

CakePHP is an open-source framework used by developers to build web applications with PHP. It provides a structured foundation that handles common tasks like database interactions and routing, allowing developers to create websites more efficiently. Because it powers the backend logic for many web platforms, vulnerabilities within its core components can impact the security of the entire application.

What does SQL injection mean for CVE-2026-77635?

This CVE involves CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it means the software fails to properly filter user input before including it in a database query. Because the application blindly trusts data provided in the jsonPath parameter, an attacker can insert their own database commands, potentially allowing them to view, change, or delete sensitive information stored in the system.

How is this vulnerability triggered?

The issue is triggered when an application using the PostgresDriver passes user-controlled data directly into the jsonPath parameter of the FunctionsBuilder::jsonValue() method. If an application does not use this specific combination—or if the input is not sourced from an external user—the specific conditions required to exploit this flaw are not met.

Why should I care if my app is internet-facing?

Halo Surface Signal indicates that applications built with this framework are frequently deployed on the public internet. Since this flaw does not require an attacker to have a valid login or special system privileges, any internet-facing application running a vulnerable version of CakePHP is potentially accessible to unauthorized actors who could attempt to interact with the database.

Is there a fix for this vulnerability?

Yes. The maintainers have released security updates in versions 5.1.10, 5.2.15, and 5.3.7 to resolve this issue. If you are responsible for an application using this framework, your primary step is to determine if you are running an affected version and prioritize upgrading to the latest patched release to neutralize the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.