UBUNTU-CVE-2026-119415: Medium severity ubuntu/cakephp vulnerability
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
Affected Software
Event History
Frequently Asked Questions
What application behavior is exposed to this issue?
Applications are exposed when they pass attacker-controlled attachment MIME types or Content-IDs to Message::setAttachments(), or attacker-controlled values into HTTP client multipart data. The vulnerable handling occurs in FormDataPart.
What does an attacker need to exploit it?
An attacker needs a way to supply CR/LF sequences in an attachment Content-Type or Content-ID value used by the application. No authentication or user interaction is indicated by the provided severity vector, but exploitation has high attack complexity.
Are default CakePHP deployments necessarily affected?
The provided information does not establish that every default deployment is exploitable. Exposure depends on whether the application accepts untrusted values for multipart attachment MIME types or Content-IDs.
What is a practical mitigation if updates cannot be applied immediately?
Do not allow untrusted input to control attachment MIME types or Content-IDs. Reject or remove carriage return and line feed characters from these values before passing them to Message::setAttachments() or multipart HTTP client functionality.
How can teams identify potentially affected code?
Review uses of Message::setAttachments() and HTTP client multipart requests, especially where Content-Type, MIME type, Content-ID, or attachment metadata originates from request data or other untrusted sources. CakePHP versions through 5.4.3 are identified as affected by the provided information.