CVE-2010-4335 — The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files

Back Back to CVE browser

HIGH

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files

Published Jan 14, 2011

7.5

HIGH

CVSS 2.0

EPSS 55.20%

Description

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

Remediation

No remediation recorded yet.

Metrics

55.20% 0.55204

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.55204

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	55.20% (0.55204)	99.00th	v5 (v2026.06.15)
Jun 15, 2026	55.20% (0.55204)	98.90th	v5 (v2026.06.15)
Sep 23, 2025	82.64% (0.82639)	99.19th	v4 (v2025.03.14)
Jul 16, 2025	84.20% (0.84201)	99.25th	v4 (v2025.03.14)
Mar 19, 2025	85.22% (0.85217)	99.32th	v4 (v2025.03.14)
Mar 17, 2025	84.21% (0.84211)	99.27th	v4 (v2025.03.14)
Dec 12, 2024	92.17% (0.92168)	99.09th	v3 (v2023.03.01)
Jun 11, 2024	91.64% (0.91642)	98.91th	v3 (v2023.03.01)
Mar 16, 2024	92.24% (0.92244)	98.90th	v3 (v2023.03.01)
Jan 31, 2024	92.65% (0.92650)	98.83th	v3 (v2023.03.01)
Dec 13, 2023	93.17% (0.93173)	98.83th	v3 (v2023.03.01)
Sep 4, 2023	92.93% (0.92929)	98.67th	v3 (v2023.03.01)
Jul 15, 2023	92.95% (0.92954)	98.61th	v3 (v2023.03.01)
May 23, 2023	93.78% (0.93783)	98.68th	v3 (v2023.03.01)
Mar 7, 2023	94.26% (0.94259)	98.64th	v3 (v2023.03.01)
Mar 6, 2023	81.53% (0.81532)	99.54th	v2 (v2022.01.01)
Mar 6, 2022	81.53% (0.81532)	99.46th	v2 (v2022.01.01)
Feb 4, 2022	82.07% (0.82067)	99.47th	v2 (v2022.01.01)

Weaknesses (1)

CWE-20

Improper Input Validation

References (9)

http://malloc.im/CakePHP-unserialize.txt
x_refsource_MISCExploit
http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
x_refsource_MISCExploit
http://secunia.com/advisories/42211
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/8026
third-party-advisoryx_refsource_SREASON
http://www.exploit-db.com/exploits/16011
exploitx_refsource_EXPLOIT-DB
http://www.osvdb.org/69352
vdb-entryx_refsource_OSVDB
https://github.com/advisories/GHSA-g2vx-8v47-4vhh
Advisory
https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb
x_refsource_CONFIRMPatch
https://nvd.nist.gov/vuln/detail/CVE-2010-4335

Link	Providers	Tags
http://malloc.im/CakePHP-unserialize.txt		x_refsource_MISCExploit
http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt		x_refsource_MISCExploit
http://secunia.com/advisories/42211		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/8026		third-party-advisoryx_refsource_SREASON
http://www.exploit-db.com/exploits/16011		exploitx_refsource_EXPLOIT-DB
http://www.osvdb.org/69352		vdb-entryx_refsource_OSVDB
https://github.com/advisories/GHSA-g2vx-8v47-4vhh		Advisory
https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb		x_refsource_CONFIRMPatch
https://nvd.nist.gov/vuln/detail/CVE-2010-4335