CVE-2026-23643

Description

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

PUBLISHED Reserved 2026-01-14 | Published 2026-01-16 | Updated 2026-01-16 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...akephp/security/advisories/GHSA-qh8m-9qxx-53m5

github.com/cakephp/cakephp/issues/19172

github.com/...ommit/c842e7f45d85696e6527d8991dd72f525ced955f

bakery.cakephp.org/2026/01/14/cakephp_5212.html

github.com/cakephp/cakephp/releases/tag/5.2.12

github.com/cakephp/cakephp/releases/tag/5.3.1

cve.org (CVE-2026-23643)

nvd.nist.gov (CVE-2026-23643)

Download JSON