Loading vulnerability…
CakePHP PostgreSQL jsonValue() SQL Injection
CVE-2026-77635 is an SQL injection vulnerability in CakePHP and the cakephp/database package. In affected releases, FunctionsBuilder::jsonValue() does not safely handle attacker-controlled input supplied as the jsonPath parameter when the PostgreSQL PostgresDriver is used. This can allow crafted JSON-path input to alter the SQL statement generated by the framework. Affected versions are 5.1.0 through 5.1.9, 5.2.0 through 5.2.14, and 5.3.0 through 5.3.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who can control the jsonPath argument in an application path using the PostgreSQL driver may execute unauthorized SQL queries. Depending on the database account privileges and application behavior, this can enable unauthorized access to, modification of, or deletion of database data. Confidentiality and integrity impact is assessed as high; availability impact may also occur through malicious queries.
If you can’t patch tonight, do this now.
Until upgrades are complete, ensure that untrusted input is never passed to FunctionsBuilder::jsonValue() as the jsonPath parameter. Restrict application database accounts to the minimum privileges required, and review application routes that construct JSON-path expressions from request-controlled data.
Patch, then assume compromise.
Upgrade CakePHP and cakephp/database to version 5.1.10, 5.2.15, or 5.3.7 or later, selecting the fixed release appropriate to the deployed maintenance branch.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.