CakePHP vulnerable to Denial of Service attack through XML payloads

Published: Jan 20, 2023
Updated: Apr 14, 2023
GHSA: <a href="https://github.com/advisories/GHSA-q79m-c546-2g63" target="_blank" rel="noopener"> GHSA-q79m-c546-2g63
Severity: High
Exploit:

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages Xml::build() which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.