PACKAGIST · SEPTEMBER 2026 · CONFIRMED

CakePHP SQL Injection Vulnerability: CVE-2026-77635 Details

Q: Am I affected?

You are affected if you are using CakePHP versions 5.1.0 to 5.3.6 with the Postgres driver and supplying user-controlled data to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.

Q: What should I do right now?

Upgrade to CakePHP versions 5.1.10, 5.2.15, or 5.3.7 and avoid supplying user-controlled data to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.

Q: Is there an official fix available?

Yes, the official fix is available in CakePHP versions 5.1.10, 5.2.15, and 5.3.7.

Severity: HIGH
Affected component: cakephp (packagist)
Affected versions: >= 5.3.0, < 5.3.7 or >= 5.2.0, < 5.2.15 or >= 5.1.0, < 5.1.10
Patched version: 5.1.10, 5.2.15, 5.3.7

GHSA-FXF7-VHH8-7VPQ

A critical SQL injection vulnerability has been confirmed in CakePHP versions 5.1.0 to 5.3.6 when using the Postgres driver. This affects the FunctionsBuilder::jsonValue() method if user-controlled data is supplied to the $jsonPath parameter.

What happened

The vulnerability, tracked as CVE-2026-77635 and GHSA-fxf7-vhh8-7vpq, allows for SQL injection when the FunctionsBuilder::jsonValue() method is used with the Postgres driver in CakePHP. This occurs specifically when user-controlled data is passed to the $jsonPath parameter, enabling malicious SQL execution. The issue was first flagged on September 8, 2026, and confirmed on September 11, 2026.

To assess your exposure, check if your application uses CakePHP versions 5.1.0 to 5.3.6 and if the Postgres driver is employed. Additionally, determine if user-controlled data is supplied to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.

What to do about it

Upgrade to CakePHP versions 5.1.10, 5.2.15, or 5.3.7 to mitigate the vulnerability.
Avoid supplying user-controlled data to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.
Review your application code to ensure no user-controlled data is passed to vulnerable methods.
Monitor the GitHub Advisory Database and official CakePHP channels for further updates and patches.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If cakephp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using CakePHP versions 5.1.0 to 5.3.6 with the Postgres driver and supplying user-controlled data to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.

What should I do right now?

Upgrade to CakePHP versions 5.1.10, 5.2.15, or 5.3.7 and avoid supplying user-controlled data to the $jsonPath parameter in the FunctionsBuilder::jsonValue() method.

Is there an official fix available?

Yes, the official fix is available in CakePHP versions 5.1.10, 5.2.15, and 5.3.7.

Sources

Join the 0Day waitlist →

← Back to all threats