Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-h378-ktx4-eufw
Vulnerability ID VCID-h378-ktx4-eufw
Aliases GHSA-q79m-c546-2g63
GMS-2023-71
Summary CakePHP vulnerable to Denial of Service attack through XML payloads RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q79m-c546-2g63
generic_textual HIGH https://github.com/cakephp/cakephp
generic_textual HIGH https://github.com/cakephp/cakephp/commit/c186487151356a8d7c6e2cae05f87b9df0e59fbb
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml
Reference id Reference type URL
https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
https://github.com/cakephp/cakephp
https://github.com/cakephp/cakephp/commit/c186487151356a8d7c6e2cae05f87b9df0e59fbb
https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml
GHSA-q79m-c546-2g63 https://github.com/advisories/GHSA-q79m-c546-2g63
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-05-30T20:59:31.499239+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2023-71.yml 38.6.0