{"id":"CVE-2026-119417","kind":"vulnerability","aliases":["CVE-2026-119417"],"related":[],"title":"CakePHP: incomplete fix lets email headers be injected, redirecting outgoing mail","description":"CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.","summary":"CakePHP's SMTP and mail transports strip only CRLF pairs from header values, so a bare CR or LF slips through. An attacker who controls custom mail headers can inject a Bcc header and redirect or alter outgoing mail.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cakephp","email","package","php"],"not_affected_if":["fixed-headers-only","no-user-controlled-headers"],"how_to_check":"- Check the CakePHP version with `composer show cakephp/cakephp`\n- Look for calls to `Message::setHeaders()` or `Message::addHeaders()` that take user-supplied values","fix":null,"status":"open","published_at":"2026-10-30T12:16:38+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:43+00:00","updated_at":"2026-10-30T12:32:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `4.5.13` or later on the 4.5 line, `4.6.6` or later on the 4.6 line, `5.1.11` or later on the 5.1 line, `5.2.16` or later on the 5.2 line, `5.3.8` or later on the 5.3 line, or `5.4.4` or later on the 5.4 line\n- unknown","reach":"internet","title":"CakePHP: incomplete fix lets email headers be injected, redirecting outgoing mail","impact":"medium","summary":"CakePHP's SMTP and mail transports strip only CRLF pairs from header values, so a bare CR or LF slips through. An attacker who controls custom mail headers can inject a Bcc header and redirect or alter outgoing mail.","audience":"developers","category":"package","nicknames":[],"who_cares":["cakephp","php","email"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker adds hidden Bcc recipients and alters outgoing mail content","analyst_note":"Confirm the fixed version ranges and whether the fix versions listed above are the ones CakePHP published, via the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-119417.","how_to_check":"- Check the CakePHP version with `composer show cakephp/cakephp`\n- Look for calls to `Message::setHeaders()` or `Message::addHeaders()` that take user-supplied values\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-headers-only","no-user-controlled-headers"],"who_is_affected":"Applications built on affected CakePHP versions that send email with custom headers taken from user input are exposed. Apps that send only fixed headers, or use no CakePHP mail transports, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4263,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119417':14A,17A '-2026':13A,16A,97C '-77634':98C '4.5.12':62C '4.6.5':63C '5.1.10':66C '5.1.8':64C '5.2.14':67C '5.2.15':69C '5.3.7':70C '5.4.0':72C '5.4.3':74C 'addhead':109C 'alter':58B,124C 'attack':44B,99C 'bare':37B,113C 'bcc':53B,121C 'cakephp':1A,18B,22B,61C 'contain':75C 'control':46B,100C 'cr':38B,114C 'crlf':30B,87C 'custom':47B,101C 'cve':12A,15A,96C 'email':5A,19B,77C 'fix':3A,94C 'header':6A,33B,49B,54B,78C,90C,102C,119C 'incomplet':2A,93C 'inject':8A,51B,79C,118C 'insert':111C 'let':4A 'lf':40B,116C 'like':120C 'mail':11A,26B,48B,60B,126C 'mailtransport':84C 'messag':105C,108C 'outgo':10A,59B,125C 'packag':20B 'pair':31B,88C 'php':21B 'redirect':9A,56B,122C 'set':103C 'sethead':106C 'slip':41B 'smtp':24B 'smtptransport':82C 'strip':28B,85C 'transport':27B 'valu':34B,91C 'via':104C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Applications built on affected CakePHP versions that send email with custom headers taken from user input are exposed. Apps that send only fixed headers, or use no CakePHP mail transports, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119417","severity":null,"published_at":"2026-10-30T12:16:38+00:00","modified_at":"2026-10-30T12:16:38+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}