Description
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cakephp cakephp
Default version status: unaffected
4.5.12 to ≤ 4.5.12affected4.6.5 to ≤ 4.6.5affected5.1.8 to ≤ 5.1.10affected5.2.14 to ≤ 5.2.15affected5.3.7 to ≤ 5.3.7affected5.4.0 to ≤ 5.4.3affected
pkg:composer/cakephp/cakephpReferences
- https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 ↗
- https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 ↗
- https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 ↗
- https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d ↗
- https://github.com/cakephp/cakephp/pull/19695 ↗
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 ↗
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 ↗
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc ↗
- https://abraxaslabs.tech/research/cakephp-smtp-crlf ↗
- https://github.com/cakephp/cakephp ↗
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport ↗