CVE-2026-77634: CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.1.8 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 5.3.7
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An application must use CakePHP's Message::setHeaders() or Message::addHeaders() to place user-controlled data into custom mail headers. The attacker must be able to supply CRLF bytes through that header value.
Which CakePHP versions are affected and which versions contain the fix?
Affected versions are those before 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines. Upgrade to the applicable listed version or a later release.
How can teams identify potentially vulnerable application code?
Review uses of Message::setHeaders() and Message::addHeaders(), especially where custom header values are derived from request parameters, form fields, API input, or other user-controlled sources. Those paths are relevant because CRLF bytes were not removed from custom headers.