8.1
HighCVSS 3.1 · from VulnCheck
CVE-2026-119419
CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
cakephp · SQL injection · CWE-89Affectedcakephp
FixA patch is linked in the references.
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 8.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incakephpup to 5.4.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known