5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23643

CVE-2026-23643: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Impact

The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.

Patches

This issue has been fixed in 5.2.12 and 5.3.1

Workarounds

If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23643

CVE-2026-23643:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cakephp/cakephp	composer	>= 5.2.10, < 5.2.12	5.2.12
cakephp/cakephp	composer	= 5.3.0	5.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the PaginatorHelper of CakePHP. The root cause is the improper handling of query string parameters when generating a form for controlling the number of items per page.

The PaginatorHelper::limitControl() method is used to create this form. To maintain the state of other query string parameters, it iterates through them and creates hidden input fields. This task is delegated to the generateHiddenFields() protected method.

The vulnerability existed because the generateHiddenFields() method used the key of each query string parameter as the name attribute for the hidden input field without applying any HTML escaping. An attacker could craft a URL with a malicious key in the query string, for example: ?page=1&<script>alert(1)</script>=foo. When the limitControl() method was called on a page with this URL, the generateHiddenFields() method would produce an HTML output containing <input type="hidden" name="<script>alert(1)</script>" value="foo">, causing the script to be executed in the user's browser.

The patch addresses this by wrapping the $fieldName variable in a call to the h() function (a shorthand for htmlspecialchars), which escapes the HTML entities and prevents the injection of malicious code. The vulnerable function is generateHiddenFields, but the user-facing entry point that would appear in logs and profiles is limitControl.

Vulnerable functions

Cake\View\Helper\PaginatorHelper::generateHiddenFields

src/View/Helper/PaginatorHelper.php

This function is responsible for generating hidden input fields. The vulnerability lies in the fact that it was using the `$fieldName` parameter, which can be controlled by query string parameters, directly in the `Form->hidden()` call without any escaping. This allows an attacker to inject malicious HTML attributes and tags by crafting a special query string.

Cake\View\Helper\PaginatorHelper::limitControl

src/View/Helper/PaginatorHelper.php

This is the public-facing method that developers use to render the pagination limit control. It is the entry point for the vulnerability because it calls the `generateHiddenFields` method with data from the current request's query string, which may contain malicious input. An exploit would involve a user visiting a URL that triggers this function's execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-23643: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Impact

Patches

Workarounds

CVE-2026-23643:

5.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2026-23643: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

Impact

Patches

Workarounds

Basic Information

Basic Information

5.4

5.4

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI