CVE-2026-23643
CVE-2026-23643 · CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
CVSS 5.4 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
cakephp
- Versions
- >= 5.2.10, < 5.2.12: Affected
- >= 5.3.0, < 5.3.1: Affected
No fix published
cakephp/cakephp Packagist
- Versions
- 5.2.10
- 5.2.11
- Affected ranges
- ECOSYSTEM: ≥ 5.2.10, < 5.2.12
Update to 5.2.12
cakephp/cakephp Packagist
- Versions
- 5.3.0
- Affected ranges
- ECOSYSTEM: ≥ 5.3.0, < 5.3.1
Update to 5.3.1
cakephp Ubuntu:16.04:LTS
- Versions
- 2.7.2-1
- 2.8.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cakephp Ubuntu:20.04:LTS
- Versions
- 2.10.11-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cakephp Ubuntu:22.04:LTS
- Versions
- 2.10.11-2.1
- 2.10.24-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5
- https://github.com/cakephp/cakephp/issues/19172
- https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f
- https://bakery.cakephp.org/2026/01/14/cakephp_5212.html
- https://github.com/cakephp/cakephp/releases/tag/5.2.12
- https://github.com/cakephp/cakephp/releases/tag/5.3.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-23643