Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119417CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

Low 3.7

In plain English

A low-severity security flaw in cakephp from cakephp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistcakephp/cakephp4.5.12GHSA-2qh5-382h-3jpc
Packagistcakephp/cakephp4.6.5GHSA-2qh5-382h-3jpc
Packagistcakephp/cakephp5.1.9GHSA-2qh5-382h-3jpc
Packagistcakephp/cakephp5.2.14GHSA-2qh5-382h-3jpc
Packagistcakephp/cakephp5.3.7GHSA-2qh5-382h-3jpc
Ubuntu:22.04:LTScakephpno fix listedUBUNTU-CVE-2026-119417

Affected products (as reported)

VendorProductVersions
cakephp cakephp 4.5.12 – through 4.5.124.6.5 – through 4.6.55.1.8 – through 5.1.105.2.14 – through 5.2.155.3.7 – through 5.3.75.4.0 – through 5.4.3

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References