CakePHP Patches SQL Injection in FunctionsBuilder Query Methods (CVE-2026-79752)

CakePHP has disclosed a SQL injection vulnerability in its ORM's FunctionsBuilder class, tracked as CVE-2026-79752 and published via GHSA-vjqc-q4mp-2rvf. According to the advisory, the cast($field, $dataType), extract($part, $expr), datePart($part, $expr), and dateAdd($expr, $value, $unit) methods are vulnerable to SQL injection when user-controlled input is passed into the $dataType, $part, or $unit parameters. A proof-of-concept is reportedly public. Fixed versions are 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12, spanning the cakephp/cakephp and cakephp/database packages.

Why It Matters

These builder methods are part of CakePHP's query-expression API, used to construct type casts and date-part extraction/arithmetic in SQL. Because CakePHP is a widely-used PHP framework, any application that passes request-derived values (query strings, form fields, API payloads) into these parameters — for example, letting a user select a date unit or cast type for a report or filter feature — is potentially exposed to SQL injection, with the usual downstream risks: data exfiltration, authentication bypass, or database tampering. Applications that only pass hardcoded, developer-controlled values to these methods are not affected by this specific flaw.

What Defenders Should Do Now

• Identify whether your application uses CakePHP and calls FunctionsBuilder::cast(), extract(), datePart(), or dateAdd() with any value derived from user input.
• Prioritize upgrading to the patched release for your branch: 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12.
• If immediate patching isn't possible, apply the vendor's documented workaround: never pass user-controlled data into the $dataType, $part, or $unit parameters — validate against a strict allow-list of expected values instead.
• Hunt for anomalous or malformed values in application logs / WAF logs on endpoints that expose date-formatting, casting, or reporting filters, and review database audit logs for unexpected query patterns tied to those code paths.
• Since a PoC is reported to be public, treat exploitation attempts as a near-term possibility rather than a theoretical risk.

This is developing intel based on a same-day GHSA advisory; details on real-world exploitation may evolve. See the original advisory for full technical detail: GHSA-vjqc-q4mp-2rvf.