CakePHP 5.2

Apply the PHP 8.4 baseline first. These rules cover CakePHP 5.2 on PHP 8.4; the published compatibility map lists PHP 8.1–8.4 for this line, which receives security fixes only, until CakePHP 5.5 is released.

Release and dependency scope

• Verify the deployed Composer lock resolves a CakePHP 5.2 release and compatible, patched plugins. The full cakephp/cakephp package replaces its split packages; for standalone cakephp/database installations, verify that package's own version.
• Retain the fixes present in 5.2.15 for PostgreSQL jsonValue(), SQL function parameters, SMTP custom headers, element path containment, paginator output, and encoded-slash routing. Follow official advisories and move to a supported patched release when required; continue applying security updates after 5.2.15.

Requests, routing, and proxy trust

• Put error handling around downstream middleware; run routing and BodyParserMiddleware before AuthenticationMiddleware, and authentication before AuthorizationMiddleware. Apply route-scoped middleware to every intended route, including alternate formats, plugin routes, and fallbacks.
• Restrict route methods and call $this->request->allowMethod() before mutations. Check the effective method after _method or X-Http-Method-Override processing; keep GET and HEAD free of application mutations.
• Authorize the controller/action and resource selected by routing. Test %2F, double encodings, and fallback routes against protected routes; raw path-prefix checks alone are insufficient even with the routing fix.
• Keep trustProxy disabled