Description
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cakephp | cakephp | >= 5.2.10, < 5.2.12, >= 5.3.0, < 5.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | cakephp | No fix yet | — |
| Ubuntu 20.04 LTS | cakephp | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cakephp | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | cakephp/cakephp | >= 5.2.10, < 5.2.12 | 5.2.12 | GHSA-qh8m-9qxx-53m5 |
| Packagist | cakephp/cakephp | >= 5.3.0, < 5.3.1 | 5.3.1 | GHSA-qh8m-9qxx-53m5 |
References
- https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5
- https://github.com/cakephp/cakephp/issues/19172
- https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f
- https://bakery.cakephp.org/2026/01/14/cakephp_5212.html
- https://github.com/cakephp/cakephp/releases/tag/5.2.12
- https://github.com/cakephp/cakephp/releases/tag/5.3.1