CVE-2026-77634: CakePHP: SmtpTransport vulnerable to CRLF header injection
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds You can strip CRLF bytes from email header values before setting header values.
Other sources
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.8 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7 - Configuration
Before calling Message::setHeaders() or Message::addHeaders(), strip CRLF bytes from any (potentially user-controlled) email header values to prevent CRLF header injection.
CakePHP Message headers (Message::setHeaders()/addHeaders()) CRLF stripping = Strip CRLF bytes from email header values before setting headers
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An application must use CakePHP's Message::setHeaders() or Message::addHeaders() to place user-controlled data into custom mail headers. The attacker must be able to supply CRLF bytes through that header value.
Which CakePHP versions are affected and which versions contain the fix?
Affected versions are those before 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines. Upgrade to the applicable listed version or a later release.
How can teams identify potentially vulnerable application code?
Review uses of Message::setHeaders() and Message::addHeaders(), especially where custom header values are derived from request parameters, form fields, API input, or other user-controlled sources. Those paths are relevant because CRLF bytes were not removed from custom headers.