Live › vulnerability › CVE-2026-119417
CakePHP's SMTP and mail transports strip only CRLF pairs from header values, so a bare CR or LF slips through. An attacker who controls custom mail headers can inject a Bcc header and redirect or alter outgoing mail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications built on affected CakePHP versions that send email with custom headers taken from user input are exposed. Apps that send only fixed headers, or use no CakePHP mail transports, can skip it.
No product ranges from the sources yet.
composer show cakephp/cakephpMessage::setHeaders() or Message::addHeaders() that take user-supplied valuesNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
This page as .md · .json · in your agent: get_signal("CVE-2026-119417")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.