GHSA-fxf7-vhh8-7vpq

Suggest an improvement
Source
https://github.com/advisories/GHSA-fxf7-vhh8-7vpq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fxf7-vhh8-7vpq
Aliases
Published
2026-09-08T20:56:41Z
Modified
2026-09-08T21:15:04Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Details

Impact

The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.

Patches

5.1.10, 5.2.15, 5.3.7

Workarounds

Don't provide user controlled data to these functions/parameters.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:56:41Z",
    "nvd_published_at": "2026-08-24T21:17:48Z",
    "severity": "CRITICAL"
}
References

Affected packages

Packagist
cakephp/cakephp

Package

Name
cakephp/cakephp
Purl
pkg:composer/cakephp/cakephp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.3.7

Affected versions

5.*
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"
cakephp/cakephp

Package

Name
cakephp/cakephp
Purl
pkg:composer/cakephp/cakephp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.15

Affected versions

5.*
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.10
5.2.11
5.2.12
5.2.13
5.2.14

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"
cakephp/cakephp

Package

Name
cakephp/cakephp
Purl
pkg:composer/cakephp/cakephp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.10

Affected versions

5.*
5.1.0
5.1.1
5.1.2
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"
cakephp/database

Package

Name
cakephp/database
Purl
pkg:composer/cakephp/database

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.3.7

Affected versions

5.*
5.3.0
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"
cakephp/database

Package

Name
cakephp/database
Purl
pkg:composer/cakephp/database

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.15

Affected versions

5.*
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.10
5.2.11
5.2.12
5.2.13
5.2.14

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"
cakephp/database

Package

Name
cakephp/database
Purl
pkg:composer/cakephp/database

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.10

Affected versions

5.*
5.1.0
5.1.1
5.1.2
5.1.4
5.1.5
5.1.6
5.1.8
5.1.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fxf7-vhh8-7vpq/GHSA-fxf7-vhh8-7vpq.json"