CVE-2010-4335

no score yetEPSS 55%

No CVSS score yet. EPSS 55% chance of exploitation in the next 30 days.

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

EPSS: 55% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2011-01-14
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

cakefoundation:cakephp
cakephp:cakephp

References

http://malloc.im/CakePHP-unserialize.txt
http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
http://secunia.com/advisories/42211
http://securityreason.com/securityalert/8026
http://www.exploit-db.com/exploits/16011

Check your stack JSON