Live › vulnerability › CVE-2026-119415
CakePHP through 5.4.3 does not strip CR/LF characters from attachment Content-Type and Content-ID values in FormDataPart. An attacker who controls those values can add arbitrary MIME part headers or content to outgoing email or HTTP multipart requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications built on CakePHP 5.4.3 or earlier that pass user-controlled attachment MIME types or Content-IDs into Message::setAttachments() or HTTP client multipart data. Applications that only use fixed attachment types, or that never accept such input from users, are unlikely to be exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
vendor/bin/cake --version or check cakephp/cakephp in composer.lock.Message::setAttachments() or multipart HTTP client data that take user-supplied MIME types or Content-IDs.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
This page as .md · .json · in your agent: get_signal("CVE-2026-119415")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.