CakePHP vulnerable to Denial of Service attack through XML payloads
Date: 2023-01
Affected: composer/cakephp/cakephp, composer/cakephp/cakephp, composer/cakephp/cakephp
Attack vector: dos
Category: vulnerability-disclosure
Severity: High

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.


Mitigations:

Architectural layers (MAESTRO):