UBUNTU-CVE-2026-119417: Medium severity ubuntu/cakephp vulnerability
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CakePHP's SmtpTransport or MailTransport are exposed when an attacker can control custom message header values passed through Message::setHeaders() or Message::addHeaders(). The issue can affect outgoing mail by injecting additional headers such as Bcc.
What does an attacker need to exploit it?
The attacker must be able to supply a custom header value to the application. Exploitation relies on inserting a bare carriage return or line feed character; no authentication or user interaction is required once that input path is available.
Are all affected CakePHP versions vulnerable by default?
The provided data identifies affected versions, but vulnerability depends on whether the application passes attacker-controlled values into custom headers via Message::setHeaders() or Message::addHeaders(). It specifically concerns SmtpTransport and MailTransport.
What can be done if upgrading is not immediately possible?
Do not allow untrusted input in custom email header values. Validate or reject carriage return and line feed characters in every value passed to Message::setHeaders() or Message::addHeaders().
How can I determine whether my application may be affected?
Check whether it uses one of the listed CakePHP versions and sends mail through SmtpTransport or MailTransport. Review calls to Message::setHeaders() and Message::addHeaders() for values derived from request data, user profiles, integrations, or other untrusted sources.