CVE-2026-119419 — Vulnerability intelligence

cakephp — cakephp

Published: 2026-10-30T11:30:50.862Z

CVSS

9.2

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.

Sources

• CVE-2026-119419
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-119419