CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Cakephp
  • Cakephp

No data.

No data.

References
Link Providers
https://abraxaslabs.tech/research/cakephp-smtp-crlf cve-icon cve-icon
https://github.com/cakephp/cakephp cve-icon cve-icon
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 cve-icon cve-icon
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d cve-icon cve-icon
https://github.com/cakephp/cakephp/pull/19695 cve-icon cve-icon
https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc cve-icon cve-icon
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport cve-icon cve-icon
History

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Title CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
First Time appeared Cakephp
Cakephp cakephp
Weaknesses CWE-93
CPEs cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*
Vendors & Products Cakephp
Cakephp cakephp
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T11:30:49.444Z

Updated: 2026-10-30T15:55:41.693Z

Reserved: 2026-10-30T02:41:11.166Z

Link: CVE-2026-119417

cve-icon Vulnrichment

Updated: 2026-10-30T15:20:56.127Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T12:16:38.213

Modified: 2026-10-30T19:07:25.060

Link: CVE-2026-119417

cve-icon Redhat

No data.