CVE catalog
CVE-2026-48820
DEBIAN-CVE-2026-48820
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.26% · Oct 25, 2026
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | cakephp | 16.04 | 2.7.2-1 | vulnerable |
| Ubuntu | cakephp | 16.04 | 2.8.0-1 | vulnerable |
| Ubuntu | cakephp | 20.04 | 2.10.11-2 | vulnerable |
| Ubuntu | cakephp | 22.04 | 2.10.11-2.1 | vulnerable |
| Ubuntu | cakephp | 22.04 | 2.10.24-1 | vulnerable |
| Debian | cakephp | 11 | 2.10.11-2.1 | vulnerable |
| Debian | cakephp | 11 | 2.10.24-1 | vulnerable |
| Debian | cakephp | 11 | 2.10.24-2 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: