CVE-2026-77635

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-77635 Write-up: https://abraxaslabs.tech/research/CVE-2026-77635 CVE-2026-77635 CakePHP 5.2.13 - cakephp I am @abraxasnull. Loopback lab. The client is CVE-2026-77635-Abraxas-Labs.py. JSONVALUE is not bound...

CVE-2026-79752

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-79752 Write-up: https://abraxaslabs.tech/research/CVE-2026-79752 CVE-2026-79752 CakePHP 5.2.13 - cakephp I am @abraxasnull. Loopback lab. The client is CVE-2026-79752-Abraxas-Labs.py. CAST AS literal...

CakeFuzzer

CakeFuzzer Latest release : 1.0 License : GNU GPL v3.0 Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives. Currently it is implemented to support the Cake...

CLSA-2026-1794405965 TuxCare security update for cakephp/cakephp (2 CVEs)

TuxCare rebuilt cakephp/cakephp to address 2 CVEs. Fixed in 2.10.24-p4+tuxcare...

CVE-2026-59192

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization...

CVE-2026-59191

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59191

The TwigView plugin for CakePHP is vulnerable to arbitrary file read due to a lack of input validation in the FileLoader::findTemplate() function. An attacker supplying un-validated, user-controlled data to this function can read files from the system. This vulnerability affects versions prior to...

CVE-2026-59191 TwigView: FileLoader is vulnerable to arbitrary file read

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59191 TwigView: FileLoader is vulnerable to arbitrary file read

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59191

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59192

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization...

CVE-2026-59192

The TwigView plugin for CakePHP is vulnerable to deserialization of untrusted data in versions prior to 1.3.3 and 2.1.2 . The root cause is that the unserialize filter lacks restrictions on allowed classes, which can be leveraged as a deserialization remote-code-execution (RCE) gadget . The issue...

CVE-2026-59192 TwigView: Deserialization of Untrusted Data

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization...

CVE-2026-59191: cakephp twig-view: TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions…

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59192: cakephp twig-view: TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions…

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization...

cakephp-window-sqli

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-window-sqli Write-up: https://abraxaslabs.tech/research/cakephp-window-sqli cakephp-window-sqli Class: SQLi Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation CVE-2026-79752 closed FunctionsBuilder...

cakephp-cookie-suffix

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-cookie-suffix Write-up: https://abraxaslabs.tech/research/cakephp-cookie-suffix cakephp-cookie-suffix Class: Cookie leak / plant Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation...

cakephp-smtp-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-smtp-crlf Write-up: https://abraxaslabs.tech/research/cakephp-smtp-crlf cakephp-smtp-crlf Class: Mail header injection Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation GHSA-2qh5 / CVE-2026-77634...

cakephp-trusted-proxies

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-trusted-proxies Write-up: https://abraxaslabs.tech/research/cakephp-trusted-proxies cakephp-trusted-proxies Class: HTTPS redirect bypass / IP-host spoof Reach: Remote CakePHP 5.4.2 887b641 - Cake Software...

Linux Distros Unpatched Vulnerability : CVE-2026-119415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type a...