CVE-2012-4399
High · 7.5CVSS
7.5
EPSS
12.1%
Published
Oct 9, 2012
CISA due date
—
The record
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | cakephp/cakephp | 2.1.0-alpha | 2.1.5 |
| Packagist | cakephp/cakephp | 2.2.0-beta | 2.2.1 |
| packagist | cakephp/cakephp | 2.1.0-alpha | No fix |
| packagist | cakephp/cakephp | 2.2.0-beta | No fix |
Related vulnerabilities
- CVE-2026-23643 CakePHP is a rapid development framework for PHP. Also affects cakephp/cakephp
- GHSA-qh8m-9qxx-53m5 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting Also affects cakephp/cakephp
- CVE-2010-4335 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… Also affects cakephp/cakephp
- CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
- CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
- CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
- CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611