Update dependency cakephp/cakephp to ^5.3.6 [SECURITY] (cakephp-5.x)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cakephp/cakephp (source)	^5.3 → ^5.3.6

---

CakePHP: View::element() is missing a path containment check

CVE-2026-48820 / GHSA-wpvj-hjcr-h3p2

More information

Details

Impact

View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server.

Patches

Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

Workarounds

If developers are not using user-supplied data in element names, no action is required.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/cakephp/cakephp/security/advisories/GHSA-wpvj-hjcr-h3p2
• https://nvd.nist.gov/vuln/detail/CVE-2026-48820
• https://github.com/advisories/GHSA-wpvj-hjcr-h3p2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

cakephp/cakephp (cakephp/cakephp)

v5.3.6: CakePHP 5.3.6 released

Compare Source

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.5. This is a maintenance release for the 5.3 branch that fixes community reported issues and a low severity security issue in View::element(). Thank you to Nguyen Danh Quan (@​z3moo) and Ta Quoc Hung (@​get-wright) for reporting this issue through our security process. The security fix has been backported and released as 5.2.13, 5.1.7, 4.6.4, and 4.5.11 as well.

Bugfixes

You can expect the following changes in 5.3.6. See the changelog for every commit.

• DateTimeType now marshals date only formats like Y-m-d to midnight.
• ConsoleOutput::_write() now guards against unset streams.
• Improved API documentation.
• Improved generic typehints for find(), findCreate() and loadInto().
• Fixed missing path normalization and directory separator handling in CommandScanner::scanPlugin().
• Improved error messages when validation rules are duplicated.
• Fixed element path name handling with relative directory traversals.

Contributors to 5.3.6

Thank you to all the contributors that submitted a pull request:

• ADmad
• Mark Scherer
• Mark Story
• Stuart

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.