{"action":"Upgrade cakephp/cakephp to 4.5.12 or later.","affected":[{"fixed":"4.5.12","introduced":"0"},{"fixed":"4.6.5","introduced":"4.6.0"},{"fixed":"5.1.9","introduced":"5.0.0"},{"fixed":"5.2.14","introduced":"5.2.0"},{"fixed":"5.3.7","introduced":"5.3.0"}],"component":"cakephp/cakephp","cve_ids":["CVE-2026-79752"],"ecosystem":"Packagist","epss":0.00621,"exploited":false,"fixed_versions":["4.5.12","4.6.5","5.1.9","5.2.14","5.3.7"],"ghsa_id":"GHSA-vjqc-q4mp-2rvf","id":"tcs_01M5KF9871FMAP99Y04464BBGE","modified_at":"2026-09-24T14:45:07.479142624Z","published_at":"2026-09-17T20:28:14Z","references":["https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf","https://github.com/cakephp/cakephp/security/advisories/GHSA-vjqc-q4mp-2rvf","https://nvd.nist.gov/vuln/detail/CVE-2026-79752","https://github.com/cakephp/cakephp/pull/19528","https://github.com/cakephp/cakephp/pull/19520","https://github.com/cakephp/cakephp/commit/79e1d6bc6f3a50fa01805579076a02c77370c676","https://github.com/cakephp/cakephp/commit/8699d6f38e25fe46fcc24f2b698809948e71ad7d","https://github.com/cakephp/cakephp/commit/ab608711674ac662af7315c5cdf1e0fbe2000e45","https://github.com/cakephp/cakephp/commit/4730e774bd3b9caa90d67af49e27a12033ec3c71","https://github.com/cakephp/cakephp/commit/3f4d13ea4280067f3381ecf935a8bef5b7cdcc2e","https://github.com/cakephp/cakephp/commit/3349584ca3a891afaff2dbc324d6b1c09fb880f0","https://github.com/cakephp/cakephp/releases/tag/4.5.12","https://github.com/cakephp/cakephp/releases/tag/4.6.5","https://github.com/cakephp/cakephp/releases/tag/5.1.8","https://github.com/cakephp/cakephp/releases/tag/5.1.9","https://github.com/cakephp/cakephp/releases/tag/5.2.14","https://github.com/cakephp/cakephp/releases/tag/5.3.7","https://github.com/cakephp/cakephp"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-vjqc-q4mp-2rvf#Packagist/cakephp/cakephp","url":"https://osv.dev/vulnerability/GHSA-vjqc-q4mp-2rvf"}],"summary":"CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection"}