CakePHP: SQL injection via collation values in StringExpression and IdentifierExpression

Summary

CakePHP through 5.4.3 does not validate collation names passed to StringExpression and IdentifierExpression. An attacker who controls a collation value can append SQL after the unquoted COLLATE clause, and the injected SQL runs with the database connection's privileges. The attack requires an application that forwards user-controlled collation or locale values into these classes; a default installation does not expose this path.

Affected

• CakePHP up to and including 5.4.3 (cakephp/cakephp Composer package)
• Vendor data lists affected versions as 0 to <= 5.4.3
• Impact is specific to applications that pass untrusted collation values into the database expression API

Fixed in

• Unknown. No fixed release has been confirmed in the sources reviewed.
• Fix commits and pull request #19726 are referenced in the CVE record; check them for the first patched 5.4.x release.

Workaround

• Do not pass untrusted input to collation parameters of StringExpression or IdentifierExpression.
• Hard-code or allowlist collation names taken from request data, imported configuration or database fields.
• Limit the privileges of the database account used by the application.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• A public research proof of concept exists (Abraxas Labs, GitHub). Treat the issue as easy to reproduce for an attacker who finds a vulnerable code path.

Our recommendation

• Check Composer lock files and dependency inventories for cakephp/cakephp versions 5.4.3 or earlier.
• Audit application code for collation values that come from user input and remove or allowlist them now.
• Upgrade to a fixed CakePHP 5.4.x release as soon as one is confirmed by the vendor.
• Prioritise internet-facing applications that handle user input near database queries.
• Monitor the CakePHP release page and security channels for the patch.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record reference: VulnCheck advisory www.vulncheck.com
• CakePHP pull request 19726 github.com
• CakePHP StringExpression.php github.com
• CakePHP IdentifierExpression.php github.com
• CakePHP releases github.com
• CakePHP end-of-life and support status github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:53.