CVE-2026-119417
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
| CWE | CWE-93 |
| Vendor | cakephp |
| Product | cakephp |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for cakephp cakephp
Be the first to know when new low vulnerabilities affecting cakephp cakephp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
cakephp / cakephp
4.5.12 ≤ 4.5.12 4.6.5 ≤ 4.6.5 5.1.8 ≤ 5.1.10 5.2.14 ≤ 5.2.15 5.3.7 ≤ 5.3.7 5.4.0 ≤ 5.4.3
References
github.com: https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 github.com: https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 github.com: https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 github.com: https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d github.com: https://github.com/cakephp/cakephp/pull/19695 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 github.com: https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 github.com: https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc abraxaslabs.tech: https://abraxaslabs.tech/research/cakephp-smtp-crlf github.com: https://github.com/cakephp/cakephp vulncheck.com: https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport
Credits
Abraxas Labs Mark Story