Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cakephp/cakephp

              5.x @ b2b38a4
            

241

Fixes

CVEs

CRITICAL

Peak severity

37.1%

Coverage

Highlights

Auth Bypass: 72 prior fixes. Scrutinize any change in this area.

cake/libs/controller/components/auth.php: most-fixed (31 issues). Treat as high-risk during review.

128 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The query builder has historically allowed SQL injection via its limit() and offset() parameters due to a lack of strict numeric validation, permitting string payload evaluation. Developers must validate that inputs are strictly numeric to prevent statement execution injection.

Auth Bypass: Case-sensitivity mismatches and URL normalization bugs across routing, the SecurityComponent, and AuthComponent have historically allowed attackers to bypass security boundaries by crafting action names with alternative casing or trailing slashes.

Deserialization of Untrusted Data: Insecure deserialization of user-controlled inputs in form-tampering tokens and session variables historically exposed the framework to remote code execution and object injection, leading to migrations away from PHP serialization to delimiter-separated formats.