{"id":"CVE-2026-119417","state":"PUBLISHED","title":"CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport","description":"CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.","publishedAt":"2026-10-30T11:30:49.444Z","updatedAt":"2026-10-30T15:55:41.693Z","severity":{"score":6.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["cakephp cakephp"],"affected":[{"vendor":"cakephp","product":"cakephp","packageURL":"pkg:composer/cakephp/cakephp","defaultStatus":"unaffected","versions":[{"version":"4.5.12","status":"affected","lessThanOrEqual":"4.5.12","versionType":"semver"},{"version":"4.6.5","status":"affected","lessThanOrEqual":"4.6.5","versionType":"semver"},{"version":"5.1.8","status":"affected","lessThanOrEqual":"5.1.10","versionType":"semver"},{"version":"5.2.14","status":"affected","lessThanOrEqual":"5.2.15","versionType":"semver"},{"version":"5.3.7","status":"affected","lessThanOrEqual":"5.3.7","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.3","versionType":"semver"}],"repo":"https://github.com/cakephp/cakephp"}],"references":["https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39","https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538","https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33","https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d","https://github.com/cakephp/cakephp/pull/19695","https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574","https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57","https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc","https://abraxaslabs.tech/research/cakephp-smtp-crlf","https://github.com/cakephp/cakephp","https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport"],"weaknesses":["CWE-93"],"ingestedAt":"2026-10-30T16:02:06.859Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/119xxx/CVE-2026-119417.json","commit":"f6a539faf8b8016bd4a4e7f5576fe5f6ea87d248","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119417","state":"PUBLISHED","datePublished":"2026-10-30T11:30:49.444Z","dateUpdated":"2026-10-30T15:55:41.693Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-30T02:41:11.166Z"},"containers":{"cna":{"title":"CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport","descriptions":[{"lang":"en","value":"CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail."}],"affected":[{"vendor":"cakephp","product":"cakephp","packageURL":"pkg:composer/cakephp/cakephp","defaultStatus":"unaffected","versions":[{"version":"4.5.12","status":"affected","lessThanOrEqual":"4.5.12","versionType":"semver"},{"version":"4.6.5","status":"affected","lessThanOrEqual":"4.6.5","versionType":"semver"},{"version":"5.1.8","status":"affected","lessThanOrEqual":"5.1.10","versionType":"semver"},{"version":"5.2.14","status":"affected","lessThanOrEqual":"5.2.15","versionType":"semver"},{"version":"5.3.7","status":"affected","lessThanOrEqual":"5.3.7","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.3","versionType":"semver"}],"repo":"https://github.com/cakephp/cakephp"}],"references":[{"url":"https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39","tags":["patch"]},{"url":"https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538","tags":["patch"]},{"url":"https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33","tags":["patch"]},{"url":"https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d","tags":["patch"]},{"url":"https://github.com/cakephp/cakephp/pull/19695","tags":["patch","issue-tracking"]},{"url":"https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574","tags":["technical-description"]},{"url":"https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57","tags":["technical-description"]},{"url":"https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc","tags":["related","vendor-advisory"],"name":"GitHub Security Advisory (GHSA-2qh5-382h-3jpc)"},{"url":"https://abraxaslabs.tech/research/cakephp-smtp-crlf","tags":["third-party-advisory"]},{"url":"https://github.com/cakephp/cakephp","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport","name":"VulnCheck Advisory: CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-93","lang":"en","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-30T11:30:49.444Z"},"datePublic":"2026-10-12T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5.12","versionEndIncluding":"4.5.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.5","versionEndIncluding":"4.6.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.8","versionEndIncluding":"5.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.14","versionEndIncluding":"5.2.15"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3.7","versionEndIncluding":"5.3.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.0","versionEndIncluding":"5.4.3"}]}]}],"credits":[{"lang":"en","value":"Abraxas Labs","type":"finder"},{"lang":"en","value":"Mark Story","type":"remediation developer"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T15:20:55.429443Z","id":"CVE-2026-119417","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T15:55:41.693Z"}}]}}}