CakePHP through version 5.4.3 is vulnerable to a SQL injection flaw that arises when unvalidated collation values are supplied to the StringExpression and IdentifierExpression classes. By controlling a collation name passed to the constructor or setCollation(), an attacker can append arbitrary SQL after the unquoted COLLATE clause. This enables the execution of malicious commands on the database, potentially allowing data theft, modification, or other destructive operations within the privileges granted to the database connection. The flaw represents a classic CWE‑89 injection weakness.

Affected systems include the CakePHP framework version 5.0 through 5.4.3. The issue affects all database drivers supported by the framework because it involves the generic StringExpression and IdentifierExpression classes used to build queries. Users running any of these versions with any database connection (MySQL, PostgreSQL, SQL Server, etc.) are impacted until the fix is applied.

The CVSS score of 9.2 classifies this vulnerability as critical. EPSS is not available, so the exploitation probability is unknown, but the severity and wide impact range suggest attackers could exploit it remotely. Likely attack vector is through normal application use—any user input that leads to a custom collation name being passed to the framework’s query builder. If the database account has elevated privileges, the attacker could gain full database compromise.