CVE-2026-48820

Summary

CakePHP: View::element() is missing a path containment check

Severity

medium

EPSS

0.3% (p17)

CWE

CWE-22

Also known as

GHSA-wpvj-hjcr-h3p2

Published

2026-06-26

Updated

2026-06-26

Advisory details

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

References

• https://github.com/advisories/GHSA-wpvj-hjcr-h3p2
• https://github.com/cakephp/cakephp/security/advisories/GHSA-wpvj-hjcr-h3p2
• https://nvd.nist.gov/vuln/detail/CVE-2026-48820

Related advisories

• CVE-2026-77635 — critical · Packagist/cakephp/cakephp
• CVE-2026-77634 — high · Packagist/cakephp/cakephp
• CVE-2026-75604 — critical · npm/next
• CVE-2026-65600 — critical · Go/github.com/traefik/traefik/v2
• CVE-2026-67429 — critical · PyPI/flyto-core
• CVE-2026-59864 — critical · NuGet/Microsoft.OpenApi.Kiota
• GHSA-p63j-vcc4-9vmv — critical · npm/@vitest/browser
• GHSA-hgjx-r89m-m7v4 — critical · Packagist/facturascripts/facturascripts

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity