CVE-2026-77634

Received Received - Intake

Header Injection in CakePHP Framework

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-77634

EUVD

EUVD-2026-65123

Affected Vendors & Products

Vendor	Product	Version / Range
cakephp	cakephp	to 4.5.12 (exc)
cakephp	cakephp	to 4.6.5 (exc)
cakephp	cakephp	to 5.1.8 (exc)
cakephp	cakephp	to 5.2.14 (exc)
cakephp	cakephp	to 5.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-77634 is a vulnerability in CakePHP, a PHP development framework. It affects versions before 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7. The issue involves custom mail headers added via Message::setHeaders() or Message::addHeaders() not properly removing CRLF bytes, enabling header injection when user-controlled data is used in message headers.

Impact Analysis

This vulnerability allows attackers to inject malicious headers into emails sent by a vulnerable CakePHP application. This could lead to phishing attacks, email spoofing, or bypassing security controls. If user-controlled data is used in email headers, attackers may manipulate headers to deceive recipients or deliver malicious content.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data access or manipulation through email header injection. GDPR requires protecting personal data integrity, while HIPAA mandates secure transmission of health information. Exploits could lead to breaches, violating these regulations and resulting in legal penalties or reputational damage.

Mitigation Strategies

Upgrade CakePHP to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, or 5.3.7 or later to address the header injection vulnerability. Review any custom mail headers using user-controlled data to ensure CRLF bytes are removed before processing.

Hi! I’m here to help you understand CVE-2026-77634. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70