CVE-2026-23643 json
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
published 9mo ago modified 4mo ago also EUVD-2026-2861 , GHSA-qh8m-9qxx-53m5
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Patch / fix
- packagist cakephp/cakephp 5.2.12, 5.3.1
- cakefoundation cakephp 5.2.12, 5.3.1
- cakephp cakephp 5.2.12, 5.3.1
Is CVE-2026-23643 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cakephp/cakephp | >=5.2.10, <5.2.12 >=5.3.0, <5.3.1 |
5.2.12 5.3.1 |
Affected products
- cakephp cakephp
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f
web, patch
-
github.com
/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5
web, vendor-advisory
-
github.com
/cakephp/cakephp/issues/19172
web, issue-tracking
-
bakery.cakephp.org
/2026/01/14/cakephp_5212.html
web, product, release-notes
-
github.com
/cakephp/cakephp/releases/tag/5.2.12
web, product, release-notes
-
github.com
/cakephp/cakephp/releases/tag/5.3.1
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-23643
advisory
-
github.com
/cakephp/cakephp
package
Sources
- CVE List CVE-2026-23643
- GitHub Advisory GHSA-qh8m-9qxx-53m5
- NVD CVE-2026-23643
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.