Is CVE-2026-119419 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119419?

CVE-2026-119419 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-119419

Description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.