---
id: CVE-2026-119417
title: >-
  CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport
  and MailTransport
summary: >-
  CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and
  5.4.0 through 5.4.3 contain an email header injection vulnerability because
  SmtpTransport and MailTransport strip only CRLF pairs from header values, an
  incom…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-93
vendor: cakephp
product: cakephp
affected:
  - cakephp >= 4.5.12 <= 4.5.12
  - cakephp >= 4.6.5 <= 4.6.5
  - cakephp >= 5.1.8 <= 5.1.10
  - cakephp >= 5.2.14 <= 5.2.15
  - cakephp >= 5.3.7 <= 5.3.7
  - cakephp >= 5.4.0 <= 5.4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:20:55.429443Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:55:41.693Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119417'
references:
  - url: >-
      https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39
  - url: >-
      https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538
  - url: >-
      https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33
  - url: >-
      https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d
  - url: 'https://github.com/cakephp/cakephp/pull/19695'
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574
  - url: >-
      https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57
  - url: 'https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc'
    label: GitHub Security Advisory (GHSA-2qh5-382h-3jpc)
  - url: 'https://abraxaslabs.tech/research/cakephp-smtp-crlf'
  - url: 'https://github.com/cakephp/cakephp'
  - url: >-
      https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport
    label: >-
      VulnCheck Advisory: CakePHP through 5.4.3 Email Header Injection via Bare
      CR/LF in SmtpTransport and MailTransport
tags:
  - cve.org
epss: 0.00452
epssPercentile: 0.39387
ingestedAt: '2026-11-05T16:07:30.526Z'
---

## Overview

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

## Affected

- `cakephp >= 4.5.12 <= 4.5.12`
- `cakephp >= 4.6.5 <= 4.6.5`
- `cakephp >= 5.1.8 <= 5.1.10`
- `cakephp >= 5.2.14 <= 5.2.15`
- `cakephp >= 5.3.7 <= 5.3.7`
- `cakephp >= 5.4.0 <= 5.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.