CVE-2026-119417
Received Received - Intake

Email Header Injection in CakePHP

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119417
EUVD
EUVD-2026-113797

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
cakephp cakephp 4.5.12
cakephp cakephp 4.6.5
cakephp cakephp 5.1.8
cakephp cakephp 5.2.14
cakephp cakephp 5.3.7
cakephp cakephp 5.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119417 is an email header injection vulnerability in CakePHP versions 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3. The issue occurs because SmtpTransport and MailTransport only remove CRLF pairs from header values, leaving them vulnerable to bare CR or LF characters. Attackers can exploit this by controlling custom headers via Message::setHeaders() or Message::addHeaders() to inject additional headers like Bcc, which can redirect or alter outgoing emails.

Detection Guidance

Check CakePHP version in use with commands like 'composer show cakephp/cakephp' or inspect vendor/cakephp/cakephp/VERSION.txt. Review custom email headers set via Message::setHeaders() or Message::addHeaders() in application code for improper sanitization.

Impact Analysis

This vulnerability allows attackers to inject email headers, potentially redirecting or altering outgoing emails. This could lead to unauthorized recipients receiving sensitive emails, data leaks, or phishing attacks. Systems using affected CakePHP versions for email functionality are at risk if custom headers are user-controlled.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized email redirection or alteration. Attackers exploiting the flaw may inject headers like Bcc to exfiltrate sensitive data or manipulate email content, compromising confidentiality and integrity of communications. GDPR requires protection of personal data during transmission, while HIPAA mandates secure handling of protected health information. The vulnerability undermines these requirements by allowing unauthorized access to email content.

Mitigation Strategies

Upgrade CakePHP to patched versions (4.5.13+, 4.6.6+, 5.1.11+, 5.2.16+, 5.3.8+, 5.4.4+). Sanitize all custom email headers by removing or escaping CR/LF characters before passing them to Message methods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119417. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart