CVE-2026-119417
lowCakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because Smtp…
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://abraxaslabs.tech/research/cakephp-smtp-crlf disclosure@vulncheck.com
- https://github.com/cakephp/cakephp disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Maile... disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Maile... disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/pull/19695 disclosure@vulncheck.com
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare... disclosure@vulncheck.com