CVE-2026-77634 json
CakePHP: SmtpTransport vulnerable to CRLF header injection
published 2mo ago modified 12d ago also CVE-2026-119417 , EUVD-2026-65123 , GHSA-2qh5-382h-3jpc
- cvss
- 8.2
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
Patch / fix
- packagist cakephp/cakephp 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
- cakefoundation cakephp 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
- cakephp cakephp 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
Is CVE-2026-77634 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cakephp/cakephp | >=4.5.0, <4.5.12 >=4.6.0, <4.6.5 >=5.0.0, <5.1.9 >=5.2.0, <5.2.14 >=5.3.0, <5.3.7 |
4.5.12 4.6.5 5.1.9 5.2.14 5.3.7 |
Affected products
- cakephp cakephp
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
github.com
/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
web
-
github.com
/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
web
-
github.com
/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
web
-
github.com
/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
web
-
github.com
/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-77634
advisory
-
github.com
/cakephp/cakephp
package
Sources
- CVE List CVE-2026-77634
- GitHub Advisory GHSA-2qh5-382h-3jpc
- NVD CVE-2026-77634
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.