Every CVE Search/ Get API key

CVE-2026-119417

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

6.3 Medium

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.45%Unchanged since Oct 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
CVE-2026-119417
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
EUVDEUVD-2026-113797 6.3

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
EUVD-2026-113797
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xmwp-gcgj-p387 6.3

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4...

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
GHSA-xmwp-gcgj-p387
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
NVD 6.3

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
CVE-2026-119417
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-93
Updated
2026-11-02
OSV 6.3

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
CVE-2026-119417
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
OSVCVE-2026-77634 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
OSVGHSA-2qh5-382h-3jpc 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact

Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

Patches

5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

Workarounds

You can strip CRLF bytes from email header values before setting header values.

Record
GHSA-2qh5-382h-3jpc
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
OSVUBUNTU-CVE-2026-119417 6.3

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
UBUNTU-CVE-2026-119417
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-05
OSVCLSA-2026-1793803616 No score

TuxCare security update for cakephp/cakephp (5 CVEs)

TuxCare rebuilt cakephp/cakephp to address 5 CVEs. Fixed in 5.0.11-p2+tuxcare.

Record
CLSA-2026-1793803616
Updated
2026-11-04

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cakephp/cakephp
TuxCare:Packagist
From an advisory covering 5 CVEs
 5.0.11 up to 5.0.11-p2+tuxcare, plus listed versions
5.0.11-p1+tuxcare
5.0.11-p2+tuxcare
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 4.5.0 up to 4.5.12, plus listed versions
4.5.14.5.104.5.114.5.24.5.3
Show 6 moreShow less
4.5.44.5.54.5.64.5.74.5.84.5.9
4.5.12
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 4.6.0 up to 4.6.5, plus listed versions
4.6.14.6.24.6.34.6.4
4.6.5
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.0.0 up to 5.1.9, plus listed versions
5.0.15.0.105.0.115.0.25.0.3
Show 16 moreShow less
5.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.15.1.25.1.45.1.55.1.65.1.75.1.8
5.1.9
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.2.0 up to 5.2.14, plus listed versions
5.2.15.2.105.2.115.2.125.2.13
Show 8 moreShow less
5.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.14
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.3.0 up to 5.3.7, plus listed versions
5.3.15.3.25.3.35.3.45.3.55.3.6
5.3.7
cakephp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1
 None known
cakephp
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.10.11-2
 None known
cakephp
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.10.11-2.12.10.24-1
 None known

History

History
RecordedChangedSources
affected, factsOSV
affected, aliasesOSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119417 is a medium vulnerability (CVSS 6.3) in Cakephp, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open