These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CakePHP Authentication plugin has a vulnerability prior to versions 2.11.1, 3.3.6, and 4.1.1. The getLoginRedirect() method contains a weakness to backslash bypasses, allowing redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue affects developers and administrators using the plugin. Patches are available to prevent potential redirects to malicious hostnames.
CVE-2026-48820 is a PHP file inclusion vulnerability in CakePHP View::_getElementFileName(). A patched release is available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, or 4.5.11. This vulnerability allows attackers to include other PHP files on the server by crafting user-supplied data. Developers and administrators should apply patches or mitigations to prevent exploitation.
CVE-2016-4793 is an IP-spoofing flaw in CakePHP’s clientIp() helper. On affected versions, a remote attacker can supply a CLIENT-IP header value that is treated as the client address, which can undermine IP-based security controls and audit data. The NVD record rates the issue HIGH with network access required but no authentication or user interaction.