CVE-2026-48820 CakePHP: View::element() is missing a path containment check
Attackers can exploit missing path checks in CakePHP's View::element() to include arbitrary PHP files, potentially leading to code execution or data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48820?
CVE-2026-48820 is a medium-severity path traversal vulnerability in cakephp, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Which versions are affected by CVE-2026-48820?
10 open source packages ship an affected version, including cakephp/cakephp.
| Package | Affected | Fixed in |
|---|---|---|
cakephp/cakephp Packagist | All versions | 4.5.11 |
cakephp/cakephp Packagist | All versions | 4.5.11 |
cakephp/cakephp Packagist | From 4.6.0 | 4.6.4 |
cakephp/cakephp Packagist | From 4.6.0 | 4.6.4 |
cakephp/cakephp Packagist | From 5.0.0 | 5.1.7 |
cakephp/cakephp Packagist | From 5.0.0 | 5.1.7 |
4 more packages
cakephp/cakephp Packagist | From 5.2.0 | 5.2.13 |
cakephp/cakephp Packagist | From 5.2.0 | 5.2.13 |
cakephp/cakephp Packagist | From 5.3.0 | 5.3.6 |
cakephp/cakephp Packagist | From 5.3.0 | 5.3.6 |
How do I fix CVE-2026-48820?
Upgrade cakephp/cakephp to a fixed version for your release line: 4.5.11, 4.6.4, 5.1.7 or 5.2.13.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48820 being exploited?
There is no known exploitation of CVE-2026-48820 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1783904619, DEBIAN-CVE-2026-48820, GHSA-wpvj-hjcr-h3p2, UBUNTU-CVE-2026-48820.