CVE-2026-119417 json
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
published 10d ago modified 10d ago also EUVD-2026-113797
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Patch / fix
- cakephp cakephp 5.4.4
- cakefoundation cakephp 5.4.4
- github.com/cakephp/cakephp@2b9326c commit
- github.com/cakephp/cakephp@7735874 commit
- github.com/cakephp/cakephp@3b99731 commit
- github.com/cakephp/cakephp@e5936b2 commit
- github.com/cakephp/cakephp#19695 pull request
Is CVE-2026-119417 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10d ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- cakephp cakephp
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
github.com
/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39
patch
-
github.com
/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538
patch
-
github.com
/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33
patch
-
github.com
/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d
patch
-
github.com
/cakephp/cakephp/pull/19695
patch, issue-tracking
-
github.com
/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
related, vendor-advisory
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574
technical-description
-
github.com
/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57
technical-description
-
abraxaslabs.tech
/research/cakephp-smtp-crlf
third-party-advisory
-
github.com
/cakephp/cakephp
product
-
vulncheck.com
/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport
third-party-advisory
Sources
- CVE List CVE-2026-119417
- NVD CVE-2026-119417
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.