CVE-2026-119417: CakePHP: SmtpTransport vulnerable to CRLF header injection
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds You can strip CRLF bytes from email header values before setting header values.
Other sources
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
— NVD
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.5.12 - Compensating control
Strip bare CR and LF bytes from email header values before setting them with Message::setHeaders() or Message::addHeaders().
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they use CakePHP mail delivery and place attacker-controlled data into custom headers through Message::setHeaders() or Message::addHeaders(). The affected transports described are SmtpTransport and MailTransport.
What does an attacker need to exploit it?
An attacker needs control over a value used as a custom email header. By supplying a bare carriage return or line feed, they can inject additional headers such as Bcc and redirect or alter outgoing mail.
Are the listed fixed versions fully protected?
The data identifies 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12 as containing fixes. It also notes that some versions containing an incomplete earlier fix remain vulnerable, including 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3.
What can be done before patching?
Strip carriage return and line feed bytes from every email header value before passing it to setHeaders() or addHeaders(). Do not place untrusted input directly into custom mail headers.