[GHSA] GHSA-vjqc-q4mp-2rvf (critical) — CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

GHSA-vjqc-q4mp-2rvf Severity: critical CVE: CVE-2026-79752

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType / $part / $unit) parameters.