Is CVE-2026-119418 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119418?

CVE-2026-119418 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-119418

Description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.