CakePHP Patches SQL Injection in Postgres jsonValue() Query Builder Function

CakePHP maintainers disclosed a SQL injection vulnerability affecting the FunctionsBuilder::jsonValue($field, $jsonPath) method when used with the PostgreSQL driver, tracked as CVE-2026-77635. The advisory, published September 8, 2026, states that if user-controlled data is passed to the $jsonPath parameter, an attacker can inject arbitrary SQL. A public proof-of-concept is available.

Why It Matters

CakePHP is a widely used PHP MVC framework, and its query builder is a common path for constructing dynamic queries. Any application using the Postgres driver that passes user-supplied input (form fields, API parameters, filter criteria) into jsonValue() as the JSON path argument is potentially exploitable — this could allow attackers to read, modify, or exfiltrate database contents depending on the application's database privileges. Applications using MySQL or other drivers with this same function are not indicated as affected per the advisory.

What Defenders Should Do Now

• Audit codebases for calls to FunctionsBuilder::jsonValue() (or higher-level query-builder JSON path helpers) and check whether any argument originates from user input.
• Upgrade to the patched releases: 5.1.10, 5.2.15, or 5.3.7.
• If immediate patching isn't possible, apply the vendor's stated workaround — do not pass user-controlled data to the $jsonPath parameter — and consider input allowlisting for any JSON path values until patched.
• Review database and application logs for anomalous query patterns or errors around JSON path fields that could indicate exploitation attempts.
• Treat this as a standard SQLi hunting scenario: watch for unusual Postgres query errors, unexpected UNION/stacked-query patterns, or out-of-band data access tied to endpoints that accept JSON path-like parameters.

This is developing, net-new intel based on a GitHub Security Advisory published today with a public PoC and no confirmed in-the-wild exploitation reported at this time. Full technical details and the official patch are available at the CakePHP GHSA-fxf7-vhh8-7vpq advisory.