CakePHP `jsonValue()` Flaw in PostgreSQL Driver Enables SQL Injection

CakePHP disclosed and patched CVE-2026-77635, a SQL injection flaw in FunctionsBuilder::jsonValue() when used with the PostgreSQL driver. The weakness allowed query manipulation if attacker-controlled input was passed to the jsonPath parameter, affecting CakePHP and cakephp/database versions >= 5.1.0, < 5.1.10, >= 5.2.0, < 5.2.15, and >= 5.3.0, < 5.3.7. The issue is tracked as CWE-89 and carries a CVSS v4 assessment indicating network exploitability, low attack complexity, no privileges required, and high confidentiality and integrity impact.

Maintainers released fixes across supported branches in commits for the 5.2.x, 5.3.x, and 5.x lines, changing how PostgreSQL-specific jsonValue expressions are transformed. Regression tests added with the patches show legitimate JSON path extraction still works, while malicious path payloads now fail with a PostgreSQL syntax error surfaced as a QueryException instead of enabling successful query manipulation. The fix was credited to reporter Himanshu Anand, and patched releases include 5.1.10, 5.2.15, and 5.3.7.