---
id: CVE-2026-119418
title: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
summary: >-
  CakePHP through 5.4.3 contains an sql injection vulnerability that allows
  attackers to inject SQL by supplying unvalidated frame offsets and directions
  to WindowExpression::range() and frame(). Attackers can pass crafted values
  through a…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: cakephp
product: cakephp
affected:
  - cakephp <= 5.4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T16:03:58.022834Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:04:14.569Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119418'
references:
  - url: >-
      https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
  - url: >-
      https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
  - url: >-
      https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
  - url: 'https://github.com/cakephp/cakephp/pull/19735'
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330
  - url: 'https://abraxaslabs.tech/research/cakephp-window-sqli'
  - url: 'https://github.com/cakephp/cakephp'
  - url: >-
      https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame
    label: >-
      VulnCheck Advisory: CakePHP through 5.4.3 SQL Injection via
      WindowExpression range() and frame()
tags:
  - cve.org
epss: 0.0048
epssPercentile: 0.41552
ingestedAt: '2026-11-05T16:24:31.057Z'
---

## Overview

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

## Affected

- `cakephp <= 5.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.