CVE-2026-77635: CakePHP PostgreSQL SQL Injection Vulnerability

CVE-2026-77635 Overview

CakePHP is a rapid development framework for PHP used to build web applications and APIs. CVE-2026-77635 is a SQL injection vulnerability [CWE-89] in the FunctionsBuilder::jsonValue() method when used with the PostgresDriver. Prior to versions 5.1.10, 5.2.15, and 5.3.7, user-controlled data supplied to the jsonPath parameter is concatenated into the generated SQL without proper parameter binding. An unauthenticated attacker can inject arbitrary SQL fragments through the JSON path expression against PostgreSQL backends.

Critical Impact
Remote, unauthenticated SQL injection against PostgreSQL-backed CakePHP applications, enabling database read and write operations and disclosure of sensitive data.

Affected Products

CakePHP release line 5.1 prior to 5.1.10
CakePHP release line 5.2 prior to 5.2.15
CakePHP release line 5.3 prior to 5.3.7

Discovery Timeline

2026-08-24 - CVE-2026-77635 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-77635

Vulnerability Analysis

The defect lives in the PostgreSQL driver's transformation of FunctionsBuilder::jsonValue() calls into a JSONB_PATH_QUERY expression. The driver iterates the expression parts and, for the second part, formats the JSON path directly into the SQL string using sprintf with quoteIdentifier rather than binding the value as a parameter. Because quoteIdentifier is intended for column and table identifiers, not user data, its escaping semantics do not neutralize jsonpath literal payloads. Any caller that passes an HTTP-derived value through the jsonPath argument therefore emits attacker-controlled SQL text into the query sent to PostgreSQL.

Root Cause

The root cause is unsafe string interpolation in src/Database/Driver/Postgres.php. The original code built the second part of the query as sprintf("'%s'::jsonpath", $this->quoteIdentifier($p['value'])), mixing user input into the SQL literal instead of using the query builder's parameter binding path. The patch removes this branch entirely so the JSON path is handled as a bound expression part by the query pipeline.

Attack Vector

Exploitation requires only network access to an endpoint that forwards untrusted input to FunctionsBuilder::jsonValue() on a PostgreSQL connection. No authentication or user interaction is needed. Attackers can break out of the jsonpath literal, close the surrounding quote, and append arbitrary SQL such as UNION SELECT statements to exfiltrate data or modify records.

php

// Patch: src/Database/Driver/Postgres.php
// Removes user-controlled sprintf into the jsonpath literal
$expression->setName('JSONB_PATH_QUERY')
    ->iterateParts(function ($p, $key) {
        if ($key === 0) {
-            $p = sprintf('%s::jsonb', $p);
-        } elseif ($key === 1) {
-            $p = sprintf("'%s'::jsonpath", $this->quoteIdentifier($p['value']));
+            return sprintf('%s::jsonb', $p);
        }

        return $p;

Source: CakePHP Commit 138f2f6

Detection Methods for CVE-2026-77635

Indicators of Compromise

PostgreSQL query logs containing JSONB_PATH_QUERY calls with unusual characters in the ::jsonpath literal, such as single quotes, semicolons, or UNION keywords.
Application logs showing FunctionsBuilder::jsonValue() invocations that receive raw request parameters as the jsonPath argument.
Web access logs with long or encoded payloads targeting endpoints that expose JSON path filtering.

Detection Strategies

Grep the codebase for calls to FunctionsBuilder::jsonValue( and confirm the second argument is a constant or validated allowlist, not request data.
Enable PostgreSQL log_statement = 'all' in non-production environments and inspect emitted SQL for malformed jsonpath literals.
Deploy web application firewall rules that flag jsonpath, ::jsonb, or SQL meta-characters appearing in query string and body parameters.

Monitoring Recommendations

Alert on database errors referencing jsonpath parsing failures, which often accompany injection probing.
Track HTTP 500 spikes on routes that expose JSON search or filter parameters.
Correlate outbound database result-set sizes with request patterns to detect bulk exfiltration attempts.

How to Mitigate CVE-2026-77635

Immediate Actions Required

Upgrade CakePHP to 5.1.10, 5.2.15, or 5.3.7 depending on the deployed release line.
Audit all controllers, tables, and query objects for calls to FunctionsBuilder::jsonValue() and remove request-supplied values from the jsonPath argument.
Rotate database credentials if logs indicate probing or successful injection against the affected code path.

Patch Information

The fix is delivered in CakePHP 5.1.10, CakePHP 5.2.15, and CakePHP 5.3.7. The security advisory is published as GHSA-fxf7-vhh8-7vpq. Corresponding commits are 138f2f6, 489a40f, and 9f1ad97.

Workarounds

Restrict the jsonPath argument to a server-side allowlist of known-safe JSON path expressions until upgrade is complete.
Validate incoming JSON path parameters against a strict regular expression that rejects quotes, semicolons, and SQL keywords.
Apply least-privilege database roles so that the CakePHP application account cannot read sensitive tables or execute administrative statements.

bash

# Composer upgrade example for each release line
composer require cakephp/cakephp:^5.3.7
# or
composer require cakephp/cakephp:^5.2.15
# or
composer require cakephp/cakephp:^5.1.10

# Verify installed version
php vendor/bin/cake version