---
id: "CVE-2026-119417"
kind: "vulnerability"
aliases: ["CVE-2026-119417"]
title: "CakePHP: incomplete fix lets email headers be injected, redirecting outgoing mail"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cakephp", "email", "package", "php"]
not_affected_if: ["fixed-headers-only", "no-user-controlled-headers"]
published_at: "2026-10-30T12:16:38+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119417", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# CakePHP: incomplete fix lets email headers be injected, redirecting outgoing mail

CakePHP's SMTP and mail transports strip only CRLF pairs from header values, so a bare CR or LF slips through. An attacker who controls custom mail headers can inject a Bcc header and redirect or alter outgoing mail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the CakePHP version with `composer show cakephp/cakephp`
- Look for calls to `Message::setHeaders()` or `Message::addHeaders()` that take user-supplied values

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119417

## From the sources

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_