Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119417— CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

Quick assessment

Affected

cakephp cakephp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CakePHP 4.5.12、4.6.5、5.1.8 至 5.1.10、5.2.14 至 5.2.15、5.3.7 以及 5.4.0 至 5.4.3 版本中存在电子邮件头部注入漏洞。该漏洞源于 SmtpTransport 和 MailTransport 组件仅从头部值中移除成对的 CRLF（回车换行），这是对 CVE-2026-77634 的不完整修复。攻击者若能通过 Message::setHeaders() 或 Message::addHeaders() 方法设置自定义头部，可插入单独的回车（CR）或换行（LF

CVSS 3.7 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

Source: CVE Program / CVE List V5

Vulnerability Description

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对CRLF序列的转义处理不恰当(CRLF注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cakephp	cakephp	4.5.12 ~ 4.5.12	-

II. Public POCs for CVE-2026-119417

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119417

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119417 (1)

🔗 SmtpTransport vulnerable to CRLF header injection · Advisory · cakephp/cakephp · GitHub related vendor-advisory

Other References for CVE-2026-119417 (10)

https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 patch
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 technical-description
https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 patch
https://github.com/cakephp/cakephp product
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 technical-description
https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 patch
https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d patch
https://github.com/cakephp/cakephp/pull/19695 patch issue-tracking
https://abraxaslabs.tech/research/cakephp-smtp-crlf third-party-advisory
https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119417

Same Patch Batch · cakephp · 2026-10-30 · 5 CVEs total

CVE-2026-119418	8.1 HIGH	CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
CVE-2026-119419	8.1 HIGH	CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collatio
CVE-2026-119416	4.8 MEDIUM	CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
CVE-2026-119415	3.7 LOW	CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

IV. Related Vulnerabilities

Same product: cakephp

Same vendor: cakephp

Same weakness: CWE-93