CVE-2026-119415Low· 3.7▾ SunlitCakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
cakephp <= 5.4.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119419High· 8.1CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
CVE-2026-119416Medium· 4.8CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
CVE-2026-79752Critical· 9.2CakePHP is a rapid development framework for PHP
CVE-2026-77634HighCakePHP is a rapid development framework for PHP
CVE-2026-119424Medium· 6.8OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
CVE-2026-115303Low· 3.7Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping