logo

Database

Reflected cross-site scripting (XSS) In cakephp/cakephp

Description

CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Impact

The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.

Patches

This issue has been fixed in 5.2.12 and 5.3.1

Workarounds

If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-236432. NVD-2026-236433. OSV-2026-236434. GHSA-qh8m-9qxx-53m55. GCVE-2026-23643

References

1. https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m52. https://github.com/cakephp/cakephp/issues/191723. https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f4. https://bakery.cakephp.org/2026/01/14/cakephp_5212.html5. https://github.com/cakephp/cakephp/releases/tag/5.2.126. https://github.com/cakephp/cakephp/releases/tag/5.3.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.