CakePHP : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln - CVE-2026-79752 - Vulnerability Database

CakePHP

CakePHP : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln - CVE-2026-79752

Medium

Reference: CVE-2026-79752

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-79752

Title: CakePHP : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln

Overview:

CakePHP is a rapid development framework for PHP. Prior to 4.5.12 4.6.5 5.1.9 5.2.14 and 5.3.7 FunctionsBuilder::cast FunctionsBuilder::extract FunctionsBuilder::datePart and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType part or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality integrity and