CVE-2026-48820: CakePHP Path Traversal Vulnerability

CVE-2026-48820 Overview

CVE-2026-48820 is a path traversal vulnerability in the CakePHP rapid development framework for PHP. The flaw resides in View::_getElementFileName(), which fails to validate that resolved element paths stay within the application or plugin view template directories. When element names are constructed from user-supplied data, attackers can leverage this weakness to include arbitrary PHP files on the server. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Remote attackers can include arbitrary local PHP files through crafted element names, potentially leading to code execution depending on which files exist on the server.

Affected Products

CakePHP 4.5.11 and earlier
CakePHP 4.6.0 through 4.6.3
CakePHP 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5

Discovery Timeline

2026-06-17 - CVE-2026-48820 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48820

Vulnerability Analysis

The vulnerability exists in the View::_getElementFileName() method, which resolves element template names to file paths on disk. The method does not enforce that the resolved path remains within the configured application or plugin view template directories. When applications pass user-controlled input into element rendering calls such as $this->element($name), an attacker can supply traversal sequences or absolute path components to escape the intended directory.

Because CakePHP loads the resolved file via PHP include-style mechanics, any PHP file readable by the web server process can be executed in the application context. The impact depends on which PHP files exist on the host, including bundled scripts, cached templates, or uploaded content. The CVSS 4.0 vector reflects high attack complexity and a passive attack requirement, since exploitation requires that the application pass untrusted input directly into element name resolution.

Root Cause

The root cause is missing path containment validation in View::_getElementFileName(). The method resolves the element name against template search paths but does not verify that the canonical resolved path is a descendant of an allowed template root. This permits directory traversal sequences and absolute paths to bypass the intended sandbox.

Attack Vector

Exploitation requires an application that passes user-supplied data into an element name argument. The attacker submits a crafted parameter containing traversal sequences that resolve to a target PHP file outside the template directory. CakePHP loads and executes the targeted file as part of view rendering. Refer to the CakePHP GHSA-wpvj-hjcr-h3p2 advisory for technical details.

Detection Methods for CVE-2026-48820

Indicators of Compromise

HTTP request parameters containing ../ sequences, encoded variants such as %2e%2e%2f, or absolute paths that flow into view rendering routes.
Unexpected PHP include or require events in application logs referencing files outside src/Template/Element or plugin element directories.
Web server access logs showing requests to endpoints that wrap user input into element rendering, paired with anomalous file system reads.

Detection Strategies

Audit application source code for calls to $this->element(), View::element(), and _getElementFileName() that receive request data without an allowlist.
Enable PHP open_basedir monitoring and log file access attempts outside the application root for forensic review.
Deploy web application firewall rules that flag path traversal patterns in parameters bound to view-rendering endpoints.

Monitoring Recommendations

Forward web server, PHP-FPM, and application logs to a centralized analytics platform for correlation of traversal patterns with downstream file access.
Alert on file inclusions resolving outside expected template directories and on unusual .php reads by the web server user.
Track CakePHP version inventory across environments to identify hosts still running affected releases.

How to Mitigate CVE-2026-48820

Immediate Actions Required

Upgrade CakePHP to a patched release: 5.3.6, 5.2.13, 5.1.7, 4.6.4, or 4.5.11's patched build, as listed in the vendor advisory.
Audit all controller and view code for element name arguments derived from $_GET, $_POST, route parameters, or request bodies.
Replace direct user input with an allowlist mapping of permitted element names before calling $this->element().

Patch Information

The CakePHP maintainers released fixes in versions 5.3.6, 5.2.13, 5.1.7, and 4.6.4, with backports referenced in the 4.5.x branch. The patched code enforces that resolved element paths remain within the registered template search directories. Full remediation details are available in the GitHub Security Advisory GHSA-wpvj-hjcr-h3p2.

Workarounds

Validate and normalize all user-supplied data before passing it to element rendering, rejecting any input containing .., /, \, or null bytes.
Implement an allowlist of permitted element names within controllers and reject any request that does not match a known value.
Restrict web server file system permissions and configure open_basedir to limit PHP file access to the application directory only.

bash

# Configuration example
composer require cakephp/cakephp:^5.3.6
# Or for the 5.2.x branch:
composer require cakephp/cakephp:^5.2.13
# Verify the installed version after upgrade:
php bin/cake.php version