CVE-2026-119417

CVSS 6.3 (medium) · published 2026-10-30

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Weakness: CWE-93

Source: NVD CVE-2026-119417

References

• https://abraxaslabs.tech/research/cakephp-smtp-crlf
• https://github.com/cakephp/cakephp
• https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57
• https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574
• https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39
• https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33
• https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538
• https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d
• https://github.com/cakephp/cakephp/pull/19695
• https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.