{"id":"CVE-2026-77634","aliases":["CLSA-2026-1789384929","CLSA-2026-1791987574","CLSA-2026-1791988278","DEBIAN-CVE-2026-77634","EUVD-2026-65123","GHSA-2qh5-382h-3jpc","UBUNTU-CVE-2026-77634"],"status":"published","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00313,"percentile":0.24363,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-08-24T20:33:46Z","modified":"2026-11-03T21:20:37Z","fixes":[{"ecosystem":"Packagist","package":"cakephp/cakephp","fixed_in":["4.5.12","4.6.5","5.1.8","5.2.14","5.3.7"],"sources":["ghsa"]},{"ecosystem":"TuxCare:Packagist","package":"cakephp/cakephp","fixed_in":["2.10.24-p3+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.6.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.7"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.24"},{"fixed":"2.10.24-p3+tuxcare"}]}],"versions":["2.10.24","2.10.24-p1+tuxcare","2.10.24-p2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.11"},{"fixed":"5.0.11-p1+tuxcare"}]}],"versions":["5.0.11"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.18"},{"fixed":"4.4.18-p1+tuxcare"}]}],"versions":["4.4.18"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.11-2.1","2.10.24-1","2.10.24-2"]},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.12"}]}],"versions":["4.5.0","4.5.1","4.5.10","4.5.11","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.6.5"}]}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3","4.6.4"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.9"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.0-RC1","5.1.0-RC2","5.1.1","5.1.2","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.14"}]}],"versions":["5.2.0","5.2.1","5.2.10","5.2.11","5.2.12","5.2.13","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.7"}]}],"versions":["5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.2-1","2.8.0-1","2.8.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.11-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.11-2.1","2.10.24-1"]}],"products":[{"vendor":"cakephp","product":"cakephp"}],"references":[{"url":"https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77634","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2qh5-382h-3jpc"},{"url":"https://abraxaslabs.tech/research/cakephp-smtp-crlf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119417.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119417","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport","tags":["advisory"]},{"url":"https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39","tags":["fix"]},{"url":"https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33","tags":["fix"]},{"url":"https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538","tags":["fix"]},{"url":"https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d","tags":["fix"]},{"url":"https://github.com/cakephp/cakephp/pull/19695","tags":["fix"]},{"url":"https://github.com/cakephp/cakephp","tags":["package"]},{"url":"https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57","tags":["article"]},{"url":"https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574","tags":["article"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77634.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77634","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77634","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-77634","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T20:33:46.836Z","modified":"2026-08-25T19:23:40.053Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-65123","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T20:33:46Z","modified":"2026-08-25T19:23:40Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:31.718552Z"}],"ghsa":[{"id":"GHSA-2qh5-382h-3jpc","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","description":"### Impact\n\nCustom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.\n\n### Patches\n5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.\n\n### Workarounds\nYou can strip CRLF bytes from email header values before setting header values.","status":"published","published":"2026-09-08T20:56:26Z","modified":"2026-09-08T20:56:26Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-77634","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T21:17:48.307Z","modified":"2026-10-12T21:10:00.227Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"CVE-2026-119417","title":"CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport","description":"CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.","status":"published","published":"2026-10-30T11:30:49.444Z","modified":"2026-11-01T02:47:29.869072279Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:57.008854Z"},{"id":"CVE-2026-77634","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T20:33:46.836Z","modified":"2026-10-31T02:55:38.121970071Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-77634","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T21:17:48.307Z","modified":"2026-08-27T23:06:20.231253114Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"GHSA-2qh5-382h-3jpc","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","description":"### Impact\n\nCustom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.\n\n### Patches\n5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.\n\n### Workarounds\nYou can strip CRLF bytes from email header values before setting header values.","status":"published","published":"2026-09-08T20:56:26Z","modified":"2026-10-31T02:55:38.121970071Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2026-77634","description":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.","status":"published","published":"2026-08-24T21:17:00Z","modified":"2026-11-03T21:20:37.952080179Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T21:41:26.825128Z"},{"id":"CLSA-2026-1789384929","title":"TuxCare security update for cakephp/cakephp (1 CVE)","description":"TuxCare rebuilt cakephp/cakephp to address 1 CVE. Fixed in 2.10.24-p3+tuxcare.","status":"published","published":"2026-09-14T11:22:09Z","modified":"2026-10-15T09:48:00.453978038Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791987574","title":"TuxCare security update for cakephp/cakephp (3 CVEs)","description":"TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 5.0.11-p1+tuxcare.","status":"published","published":"2026-10-14T14:19:34Z","modified":"2026-10-15T09:48:04.856540009Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791988278","title":"TuxCare security update for cakephp/cakephp (3 CVEs)","description":"TuxCare rebuilt cakephp/cakephp to address 3 CVEs. Fixed in 4.4.18-p1+tuxcare.","status":"published","published":"2026-10-14T14:31:18Z","modified":"2026-10-15T09:48:04.913525285Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}