Low severity3.7NVD Advisory· Published Oct 30, 2026
CVE-2026-119417
CVE-2026-119417
Description
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected products
1Patches
Vulnerability mechanics
References
10- abraxaslabs.tech/research/cakephp-smtp-crlfnvd
- github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.phpnvd
- github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.phpnvd
- github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39nvd
- github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33nvd
- github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538nvd
- github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557dnvd
- github.com/cakephp/cakephp/pull/19695nvd
- github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpcnvd
- www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransportnvd
News mentions
0No linked articles in our index yet.