CVE-2026-119415
Received Received - Intake

CakePHP 5.4.3 Header Injection via FormDataPart

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119415
EUVD
EUVD-2026-113795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cakephp cakephp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119415 is a header injection vulnerability in CakePHP versions up to 5.4.3. It occurs in the FormDataPart component when unsanitized user input is used in HTTP client requests or email messages. Attackers can inject CR/LF sequences into Content-Type or Content-ID values to add arbitrary headers or manipulate MIME parts, enabling attacks like HTTP response splitting or email header injection.

Detection Guidance

To detect this vulnerability, inspect HTTP client requests or email messages generated by CakePHP applications for unsanitized newline characters in Content-Type or Content-ID headers. Check FormDataPart objects for improperly sanitized header values. Use network monitoring tools to analyze multipart requests for CR/LF sequences in attachment metadata.

Impact Analysis

This vulnerability allows attackers to inject malicious headers into HTTP requests or email messages. This could lead to unauthorized data access, session hijacking, phishing attacks, or manipulation of application behavior. Systems using CakePHP 5.4.3 or earlier for file uploads, email sending, or API requests are at risk if user input is not properly validated.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data access or manipulation, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using vulnerable CakePHP versions must address this to maintain regulatory compliance and prevent data breaches.

Mitigation Strategies

Update CakePHP to version 5.4.4 or later. If using version 4.x, apply the backported fix. Ensure all user-controlled input in Content-Type, Content-ID, and other headers is sanitized by removing CR/LF characters before processing. Review and test email attachments and HTTP client requests for proper header handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart