FunctionsBuilder::jsonValue() with the PostgresDriver in CakePHP contains a flaw that allows an attacker to inject arbitrary SQL when a crafted jsonPath parameter is supplied. The injected query can read, modify or delete data in the underlying Postgres database, giving the attacker potential full database compromise. This flaw directly exploits a weakness classified as CWE‑89 and results in a confidentiality and integrity breach if executed.

Vulnerable systems include any PHP application built with CakePHP version 5.1 prior to 5.1.10, 5.2 prior to 5.2.15, or 5.3 prior to 5.3.7 that uses the PostgresDriver component. The libraries affected are the cakephp/cakephp and cakephp/cakephp/database packages, as listed by the CNA vendor/product names in the advisory.

The CVSS score of 9.2 highlights critical severity; the lack of an EPSS score means no public exploitation data is reported yet, but the flaw is listed as not KEV. The attack could be performed remotely via a manipulated web request that delivers a malicious jsonPath value. Successful exploitation requires the application to accept the jsonPath parameter from user input and to use the vulnerable FunctionsBuilder::jsonValue() method. Given the high severity, the potential impact is full data compromise on affected installations.