Headline
GHSA-p76f-wr22-4rv6: CakePHP vulnerable to Remote File Inclusion through View template name manipulation
CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.
Package
composer cakephp/cakephp (Composer)
Affected versions
>= 2.0.0, < 2.0.99
>= 2.1.0, < 2.1.99
>= 2.2.0, < 2.2.99
>= 2.3.0, < 2.3.99
>= 2.4.0, < 2.4.99
>= 2.5.0, < 2.5.99
>= 2.6.0, < 2.6.12
>= 2.7.0, < 2.7.6
>= 3.0.0, < 3.0.15
>= 3.1.0, < 3.1.4
Patched versions
2.0.99
2.1.99
2.2.99
2.3.99
2.4.99
2.5.99
2.6.12
2.7.6
3.0.15
3.1.4