{"action":"Upgrade cakephp/cakephp to 4.5.11 or later.","affected":[{"fixed":"5.3.6","introduced":"5.3.0"},{"fixed":"5.2.13","introduced":"5.2.0"},{"fixed":"5.1.7","introduced":"5.0.0"},{"fixed":"4.6.4","introduced":"4.6.0"},{"fixed":"4.5.11","introduced":"0"}],"component":"cakephp/cakephp","cve_ids":["CVE-2026-48820"],"ecosystem":"Packagist","epss":0.0037,"exploited":false,"fixed_versions":["5.3.6","5.2.13","5.1.7","4.6.4","4.5.11"],"ghsa_id":"GHSA-wpvj-hjcr-h3p2","id":"tcs_01M5KFA92X8765W0CS2TWRCCHZ","modified_at":"2026-09-10T03:50:50.960270447Z","published_at":"2026-06-26T21:00:10Z","references":["https://osv.dev/vulnerability/GHSA-wpvj-hjcr-h3p2","https://github.com/cakephp/cakephp/security/advisories/GHSA-wpvj-hjcr-h3p2","https://nvd.nist.gov/vuln/detail/CVE-2026-48820","https://github.com/cakephp/cakephp"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-wpvj-hjcr-h3p2","url":"https://osv.dev/vulnerability/GHSA-wpvj-hjcr-h3p2"}],"summary":"CakePHP: View::element() is missing a path containment check"}