High priorityDisclosed

Advisory · CVE-2026-119419

CakePHP SQL injection via unvalidated collation values

CakePHP through 5.4.3 lets attackers inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression.

Advisory published October 30, 2026Independent summary
Vendor
CakePHP
Product
CakePHP
Identifier / CWE
CVE-2026-119419
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

A collation is just a label for how a database sorts text, and it is supposed to be quoted safely. Here the label is pasted into the query unquoted, so an attacker who controls the label can append their own database commands after it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Collation value controlled

    An attacker supplies a collation name to StringExpression or setCollation().

  2. 02Unquoted clause

    The value is placed into the SQL COLLATE clause without quoting.

  3. 03Injection appended

    SQL appended after the collation value becomes part of the query.

  4. 04Database access

    The injected SQL runs with the privileges of the database connection.

What happened

CakePHP through 5.4.3 contains a SQL injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection’s privileges. The record rates it high at CVSS 8.1.

Fix commits are referenced in pull request 19726, but no fixed release is stated in the sources checked for this run, so this advisory claims none. Until a patched release ships, the defense is to never let untrusted input reach a collation value.

What to do

  1. Inventory CakePHP applications and identify where collation values are set.
  2. Allowlist collation values to known-safe names and reject anything else; never pass user input directly as a collation.
  3. Track the vendor fix in pull request 19726 and upgrade to a patched release as soon as the vendor publishes one.
  4. Review database logs for unusual queries or collation values containing SQL syntax.
  5. Verify the deployed version after upgrading.

Management note

Framework-level SQL injection is a data-breach risk, not a single-app bug. Audit every place a collation can be influenced by outside input, and treat the allowlist as the interim fix until the patched release arrives.