Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/cakephp/cakephp@4.1.4
purl pkg:composer/cakephp/cakephp@4.1.4
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-xsdu-qsw4-ebaz Cross-Site Request Forgery (CSRF) A vulnerability exists in CakePHP The `CsrfProtectionMiddleware` component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method. CVE-2020-35239
GHSA-9pgx-pf36-w46r

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:28:16.645535+00:00 GHSA Importer Fixing VCID-xsdu-qsw4-ebaz https://github.com/advisories/GHSA-9pgx-pf36-w46r 38.6.0
2026-06-04T17:54:11.001394+00:00 GithubOSV Importer Fixing VCID-xsdu-qsw4-ebaz https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9pgx-pf36-w46r/GHSA-9pgx-pf36-w46r.json 38.6.0
2026-06-04T16:20:45.449069+00:00 GitLab Importer Fixing VCID-xsdu-qsw4-ebaz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-35239.yml 38.6.0