low3.7
CVE-2026-119417
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because Smtp…
Impact
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected products
| Product | Affected versions |
|---|---|
| CakePHP 4.5.12, 4.6.5, 5.1.8 | through 5.1.10 |
| 5.2.14 | through 5.2.15 |
| 5.3.7, And 5.4.0 | through 5.4.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://abraxaslabs.tech/research/cakephp-smtp-crlf
- https://github.com/cakephp/cakephp
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574
- https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39
- https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33
- https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538
- https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d
- https://github.com/cakephp/cakephp/pull/19695
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport