GHSA-qh8m-9qxx-53m5MediumCVSS 5.4

CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Published
January 16, 2026
Last Modified
January 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-23643 →

📋 Description

Impact

The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.

Patches

This issue has been fixed in 5.2.12 and 5.3.1

Workarounds

If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.

🎯 Affected products2

  • composer/cakephp/cakephp:>= 5.2.10, < 5.2.12
  • composer/cakephp/cakephp:= 5.3.0

🔗 References (8)