CVE-2026-119415— CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

Quick assessment

Affected

cakephp cakephp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CakePHP 5.4.3 及更早版本在 FormDataPart 组件中存在一个 HTTP 请求头注入漏洞。该漏洞允许攻击者通过未经验证的 Content-Type 和 Content-ID 值，注入 MIME 部分请求头。攻击者可以在传递给 Message::setAttachments() 方法的附件 MIME 类型或 Content-ID，或在 HTTP 客户端的多部分（multipart）数据中，插入回车换行（CR/LF）序列，从而添加任意请求头或内容。

CVSS 3.7 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

Source: CVE Program / CVE List V5

Vulnerability Description

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对CRLF序列的转义处理不恰当(CRLF注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cakephp	cakephp	0 ~ 5.4.3	-

II. Public POCs for CVE-2026-119415

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119415

请登录查看更多情报信息。

Other References for CVE-2026-119415 (10)

https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2 patch
https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a patch
https://abraxaslabs.tech/research/cakephp-attachment-crlf third-party-advisory
https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5 patch
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Message.php#L1181 technical-description
https://github.com/cakephp/cakephp product
https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e patch
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200 technical-description
https://github.com/cakephp/cakephp/pull/19715 patch issue-tracking
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-mime-header-injection-via-formdatapart-content-type third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119415

Same Patch Batch · cakephp · 2026-10-30 · 5 CVEs total

CVE-2026-119418	8.1 HIGH	CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
CVE-2026-119419	8.1 HIGH	CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collatio
CVE-2026-119416	4.8 MEDIUM	CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
CVE-2026-119417	3.7 LOW	CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTrans

IV. Related Vulnerabilities

Same product: cakephp

Same vendor: cakephp

Same weakness: CWE-93