CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
cakephp cakephp unaffected
Version Status Constraints
4.5.12 affected ≤ 4.5.12
4.6.5 affected ≤ 4.6.5
5.1.8 affected ≤ 5.1.10
5.2.14 affected ≤ 5.2.15
5.3.7 affected ≤ 5.3.7
5.4.0 affected ≤ 5.4.3

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Cakephp Subscribe
Cakephp Subscribe

Project Subscriptions

Vendors Products
Cakephp Subscribe
Cakephp Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://abraxaslabs.tech/research/cakephp-smtp-crlf cve-icon cve-icon
https://github.com/cakephp/cakephp cve-icon cve-icon
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 cve-icon cve-icon
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 cve-icon cve-icon
https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d cve-icon cve-icon
https://github.com/cakephp/cakephp/pull/19695 cve-icon cve-icon
https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc cve-icon cve-icon
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport cve-icon cve-icon
History

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Title CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
First Time appeared Cakephp
Cakephp cakephp
Weaknesses CWE-93
CPEs cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*
Vendors & Products Cakephp
Cakephp cakephp
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T15:55:41.693Z

Reserved: 2026-10-30T02:41:11.166Z

Link: CVE-2026-119417

cve-icon Vulnrichment

Updated: 2026-10-30T15:20:56.127Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T12:16:38.213

Modified: 2026-10-30T19:07:25.060

Link: CVE-2026-119417

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T13:30:12Z

Weaknesses