CVE-2026-119417 | BDVDB-2026-398487 Detail
cakephpcakephp
Description#
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
References#
- https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39
- https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538
- https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33
- https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d
- https://github.com/cakephp/cakephp/pull/19695
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://abraxaslabs.tech/research/cakephp-smtp-crlf
- https://github.com/cakephp/cakephp
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.