GHSA-2qh5-382h-3jpcHigh
CakePHP: SmtpTransport vulnerable to CRLF header injection
🔗 CVE IDs covered (1)
📋 Description
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds
You can strip CRLF bytes from email header values before setting header values.
🎯 Affected products5
- composer/cakephp/cakephp:>= 4.5.0, < 4.5.12
- composer/cakephp/cakephp:>= 4.6.0, < 4.6.5
- composer/cakephp/cakephp:>= 5.0.0, < 5.1.8
- composer/cakephp/cakephp:>= 5.2.0, < 5.2.14
- composer/cakephp/cakephp:>= 5.3.0, < 5.3.7
🔗 References (7)
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://nvd.nist.gov/vuln/detail/CVE-2026-77634
- https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
- https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
- https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
- https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
- https://github.com/advisories/GHSA-2qh5-382h-3jpc