Every CVE Search/ Get API key

CVE-2026-77634

CakePHP: SmtpTransport vulnerable to CRLF header injection

8.2 HighFix available

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.31%Unchanged since Aug 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
EUVDEUVD-2026-65123 8.2

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
EUVD-2026-65123
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2qh5-382h-3jpc 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact

Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

Patches

5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

Workarounds

You can strip CRLF bytes from email header values before setting header values.

Record
GHSA-2qh5-382h-3jpc
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
NVD 8.2

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-93
Updated
2026-11-02
OSVCVE-2026-119417 6.3

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Record
CVE-2026-119417
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
OSV 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-77634 8.2

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
DEBIAN-CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-2qh5-382h-3jpc 8.2

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact

Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

Patches

5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

Workarounds

You can strip CRLF bytes from email header values before setting header values.

Record
GHSA-2qh5-382h-3jpc
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-93
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77634 8.2

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Record
UBUNTU-CVE-2026-77634
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
OSVCLSA-2026-1789384929 No score

TuxCare security update for cakephp/cakephp (1 CVE)

TuxCare rebuilt cakephp/cakephp to address 1 CVE. Fixed in 2.10.24-p3+tuxcare.

Record
CLSA-2026-1789384929
Updated
2026-11-02
OSVCLSA-2026-1791987574 No score

TuxCare security update for cakephp/cakephp (3 CVEs)

TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 5.0.11-p1+tuxcare.

Record
CLSA-2026-1791987574
Updated
2026-11-02
OSVCLSA-2026-1791988278 No score

TuxCare security update for cakephp/cakephp (3 CVEs)

TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 4.4.18-p1+tuxcare.

Record
CLSA-2026-1791988278
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cakephp/cakephp
Packagist
 4.5.0 up to 4.5.12
4.5.12
cakephp/cakephp
Packagist
 4.6.0 up to 4.6.5
4.6.5
cakephp/cakephp
Packagist
 5.0.0 up to 5.1.8
5.1.8
cakephp/cakephp
Packagist
 5.2.0 up to 5.2.14
5.2.14
cakephp/cakephp
Packagist
 5.3.0 up to 5.3.7
5.3.7
cakephp/cakephp
TuxCare:Packagist
 2.10.24 up to 2.10.24-p3+tuxcare, plus listed versions
2.10.24-p1+tuxcare2.10.24-p2+tuxcare
2.10.24-p3+tuxcare
cakephp/cakephp
TuxCare:Packagist
From an advisory covering 3 CVEs
 5.0.11 up to 5.0.11-p1+tuxcare
5.0.11-p1+tuxcare
cakephp/cakephp
TuxCare:Packagist
From an advisory covering 3 CVEs
 4.4.18 up to 4.4.18-p1+tuxcare
4.4.18-p1+tuxcare
cakephp
Debian:11
 All versions, plus listed versions
2.10.11-2.12.10.24-12.10.24-2
 None known
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 4.5.0 up to 4.5.12, plus listed versions
4.5.14.5.104.5.114.5.24.5.3
Show 6 moreShow less
4.5.44.5.54.5.64.5.74.5.84.5.9
4.5.12
Show 7 moreShow less
Affected packages
PackageAffectedFixed
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 4.6.0 up to 4.6.5, plus listed versions
4.6.14.6.24.6.34.6.4
4.6.5
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.0.0 up to 5.1.9, plus listed versions
5.0.15.0.105.0.115.0.25.0.3
Show 16 moreShow less
5.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.15.1.25.1.45.1.55.1.65.1.75.1.8
5.1.9
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.2.0 up to 5.2.14, plus listed versions
5.2.15.2.105.2.115.2.125.2.13
Show 8 moreShow less
5.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.14
cakephp/cakephp
Packagist
From an advisory covering 2 CVEs
 5.3.0 up to 5.3.7, plus listed versions
5.3.15.3.25.3.35.3.45.3.55.3.6
5.3.7
cakephp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.2-12.8.0-12.8.0-1ubuntu0.1~esm1
 None known
cakephp
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.10.11-2
 None known
cakephp
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.10.11-2.12.10.24-1
 None known

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77634 is a high vulnerability (CVSS 8.2) in Cakephp, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in cakephp/cakephp 4.5.12.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open