CVE-2026-23643 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Attackers can execute arbitrary scripts in user browsers via reflected XSS in CakePHP's PaginatorHelper limit control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23643?
CVE-2026-23643 is a medium-severity cross-site scripting vulnerability in cakephp, published on 16 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-23643?
4 open source packages ship an affected version, including cakephp/cakephp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cakephp/cakephp Packagist | From 5.2.10 | 5.2.12 |
cakephp/cakephp Packagist | From 5.2.10 | 5.2.12 |
cakephp/cakephp Packagist | From 5.3.0 | 5.3.1 |
cakephp/cakephp Packagist | From 5.3.0 | 5.3.1 |
Products include Cakephp Cakephp.
How do I fix CVE-2026-23643?
Upgrade cakephp/cakephp to a fixed version for your release line: 5.2.12 or 5.3.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23643 exists.
Other vulnerabilities in cakephp
- CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp
- CVE-2020-35239 CakePHP allows method override parameters to bypass CSRF checks
- CVE-2015-8379 CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
- CVE-2019-11458 Unsafe deserialization in SmtpTransport in CakePHP
- CVE-2016-4793 CakePHP allows remote attackers to spoof their IP
Sources
Also known as GHSA-qh8m-9qxx-53m5, UBUNTU-CVE-2026-23643.