CVE-2026-48820

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-98"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48820.json"
}

References

Affected packages

Git / github.com/cakephp/cakephp

Affected ranges

Type

GIT

Repo

https://github.com/cakephp/cakephp

Events

Introduced

c0175d821a5e42b934ad2a11927c5c5d0e659a0d

Fixed

cdaca8c3b710789e8545bff5a83194a6b19cad46

Introduced

8eb600bb67a545e2d108f9ae64146f094a39bb55

Fixed

199f0246ad497977e03f280a018b3fbebdc41071

Introduced

2da6ed819f520e472ea12b011a9c7a7f39310a4a

Fixed

3b7d95dc6c5d34a8d9f080cc592bee03da316596

Introduced

b8585672346c0654311c77500ce613cdf37687cc

Fixed

70b5c1097866f7f392d052ab4514c9705449fb3f

Introduced

Fixed

005df99489c1a7e0f4d3d39878389ddc733218fe

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "5.3.0"
                },
                {
                    "fixed":  "5.3.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "5.2.0"
                },
                {
                    "fixed":  "5.2.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "fixed":  "5.1.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "4.6.0"
                },
                {
                    "fixed":  "4.6.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4.5.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        }
    ]
}

Affected versions

1.*

1.2.0

1.2.1

1.3-dev

1.3.0-RC1

1.3.0-RC2

1.3.0-alpha

1.3.0-beta

2.*

2.0.0-RC1

2.0.0-alpha

2.0.0-beta

2.0.0-dev

2.1.0

2.1.0-RC

2.1.0-alpha

2.1.0-beta

2.2.0-RC1

2.2.0-beta

3.*

3.0.0

3.0.0-RC1

3.0.0-RC2

3.0.0-alpha1

3.0.0-alpha2

3.0.0-beta1

3.0.0-beta2

3.0.0-beta3

3.0.0-dev1

3.0.0-dev2

3.0.0-dev3

3.0.1

3.0.10

3.0.11

3.0.12

3.0.13

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.2.0

3.3.0-RC1

3.3.0-beta

3.3.0-beta2

3.3.0-beta3

3.4.0-RC1

3.4.0-RC2

3.4.0-RC3

3.4.0-RC4

3.4.0-beta1

3.4.0-beta2

3.4.0-beta3

3.4.0-beta4

3.5.0

3.5.0-RC1

3.5.0-RC2

3.5.1

3.5.10

3.5.11

3.5.12

3.5.13

3.5.14

3.5.15

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

3.5.9

3.6.0

4.*

4.0.0

4.0.0-RC1

4.0.0-RC2

4.0.0-alpha1

4.0.0-alpha2

4.0.0-beta1

4.0.0-beta2

4.0.0-beta3

4.0.0-beta4

4.1.0-RC1

4.1.0-RC2

4.1.0-beta1

4.2.0-RC1

4.2.0-beta1

4.3.0-RC1

4.3.0-RC2

4.3.0-RC3

4.3.0-RC4

4.4.0

4.4.0-RC1

4.4.0-RC2

4.4.1

4.4.10

4.4.11

4.4.12

4.4.13

4.4.14

4.4.15

4.4.16

4.4.17

4.4.18

4.4.2

4.4.3

4.4.4

4.4.5

4.4.6

4.4.7

4.4.8

4.4.9

4.5.0

4.5.1

4.5.10

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.5.7

4.5.8

4.5.9

4.6.0

4.6.1

4.6.2

4.6.3

5.*

5.0.0

5.0.1

5.0.10

5.0.11

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.1.0

5.1.1

5.1.2

5.1.4

5.1.5

5.1.6

5.2.0

5.2.1

5.2.10

5.2.11

5.2.12

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48820.json"