CakePHP: SQL injection via WindowExpression range() and frame()
Summary
CakePHP through 5.4.3 does not validate frame offsets and directions passed to WindowExpression::range() and frame(). If an application forwards unvalidated user input into the OVER clause, an attacker can inject SQL and run it with the privileges of the database connection. Default CakePHP installations do not expose this method to user input by themselves.
Affected
- CakePHP through 5.4.3 (cakephp/cakephp and cakephp/database)
- Whether 4.x releases are affected is unknown.
Fixed in
Unknown. No fixed version is confirmed in the sources reviewed. Do not treat CakePHP 5.1.10, 5.2.15 or 5.3.7 as fixes; they belong to CVE-2026-77635.
Workaround
- Do not pass untrusted input into range() or frame().
- If this is not possible, allowlist the frame type (RANGE, ROWS, GROUPS) and the direction (PRECEDING, FOLLOWING) and validate offsets strictly.
- Limit the privileges of the database account.
Exploitation
- A public proof of concept exists for a lab setup.
- No confirmed exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- NVD status is Deferred.
Our recommendation
- Inventory all CakePHP installations, including 4.x, using composer.lock files.
- Search custom code for calls to range() or frame() that receive request data and remove or validate this input.
- Apply the workaround now and restrict database account privileges.
- Upgrade to the first fixed 5.x release once the vendor confirms it; plan migration away from 4.x.
- Monitor the NVD entry and the vendor advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record / VulnCheck advisory www.vulncheck.com
- Abraxas Labs research abraxaslabs.tech
- CakePHP WindowExpression.php (5.x) github.com
- CakePHP security policy github.com
- CakePHP repository github.com
- Strix CVE-2026-119418 www.strix.ai
- VulDB 428998 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:53.
Original description (NVD)
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
NVD references (9)
- https://abraxaslabs.tech/research/cakephp-window-sqli
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/Wind…
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/Wind…
- https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
- https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
- https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
- https://github.com/cakephp/cakephp/pull/19735
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.