The vulnerability resides in the View::_getElementFileName() method of CakePHP, which fails to confirm that a resolved element file lies within the intended application or plugin view template directories. When an attacker supplies a specially crafted element name, this flaw can lead to the inclusion of arbitrary PHP files on the server. Such inclusion can enable the attacker to execute arbitrary code, violating the confidentiality, integrity, and availability of the application environment. The weakness is classified as CWE-22 (Path Traversal) and CWE-98 (Relative Path Traversal).

CakePHP framework versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5 are affected. Patched releases are available in 4.5.11, 4.6.4, 5.1.7, 5.2.13, and 5.3.6.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score of less than 1% signals a very low likelihood of exploitation at present. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. The most probable attack vector involves an attacker supplying a malicious element name through a user‑controlled request, thereby bypassing the path containment check and triggering file inclusion. With the ability to execute arbitrary PHP, the attacker may gain full control of the application.