🔐 CVE Alert

CVE-2026-119415

LOW 3.7

CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

CWE CWE-93
Vendor cakephp
Product cakephp
Published Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for cakephp cakephp

Be the first to know when new low vulnerabilities affecting cakephp cakephp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected Versions

cakephp / cakephp
0 ≤ 5.4.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5 github.com: https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2 github.com: https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e github.com: https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a github.com: https://github.com/cakephp/cakephp/pull/19715 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Message.php#L1181 abraxaslabs.tech: https://abraxaslabs.tech/research/cakephp-attachment-crlf github.com: https://github.com/cakephp/cakephp vulncheck.com: https://www.vulncheck.com/advisories/cakephp-through-5.4.3-mime-header-injection-via-formdatapart-content-type

Credits

Abraxas Labs Mark Story