CVE-2026-119418— CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Quick assessment

Affected

cakephp cakephp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CakePHP 5.4.3 及更早版本存在 SQL 注入漏洞，攻击者可通过向和方法提供未经验证的帧偏移量（frame offsets）和方向（directions）来注入 SQL 代码。若应用程序将用户输入直接转发至子句，攻击者可利用精心构造的值，以数据库连接所拥有的权限执行恶意 SQL 语句。

CVSS 8.1 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Source: CVE Program / CVE List V5

Vulnerability Description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cakephp	cakephp	0 ~ 5.4.3	-

II. Public POCs for CVE-2026-119418

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119418

请登录查看更多情报信息。

Other References for CVE-2026-119418 (9)

https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565 patch
https://github.com/cakephp/cakephp/pull/19735 patch issue-tracking
https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9 patch
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152 technical-description
https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f patch
https://github.com/cakephp/cakephp product
https://abraxaslabs.tech/research/cakephp-window-sqli third-party-advisory
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330 technical-description
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119418

Same Patch Batch · cakephp · 2026-10-30 · 5 CVEs total

CVE-2026-119419	8.1 HIGH	CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collatio
CVE-2026-119416	4.8 MEDIUM	CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
CVE-2026-119415	3.7 LOW	CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
CVE-2026-119417	3.7 LOW	CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTrans

IV. Related Vulnerabilities

Same product: cakephp

Same vendor: cakephp

Same weakness: CWE-89